I'm always baffled when I go to set up multi-factor authentication, and the only option is to receive one-time codes via SMS. It's certainly better than not supporting MFA at all. But it sends a message on behalf of your brand: we do the bare minimum.

And it satisfies no one. Security-conscious users will be annoyed because (a) they can't use their preferred MFA approach, and (b) they understand that if someone truly wanted to take over their account, they could probably pay an insider $500 to execute a SIM swap (ask a T-Mobile customer) or attempt a smishing attack (ask a Verizon customer). Less technical users won't turn it on at all, because it's a poor user experience.

There's also a growing trend of passwordless authentication using one-time email links. This is probably more secure than just a straight login and password. It eliminates the risk that a database of customer passwords somewhere will be compromised. But this approach pushes the authentication process into one of the biggest attack surfaces out there: the email inbox.

It's also not just account access that is being authenticated with emails. One of the things that big tech companies don't talk about much is how often they turn over information about their customers to law enforcement agencies. There are many legal and legitimate reasons for them to do it. But it also isn't something that can be taken lightly from a customer privacy standpoint.

Big companies like Meta and Apple often set up secure portals for information requests. But they also take requests via – you guessed it – email. According to a recent Bloomberg article, here's how that story ends:

Apple Inc. and Meta Platforms Inc., the parent company of Facebook, provided customer data to hackers who masqueraded as law enforcement officials, according to three people with knowledge of the matter. Apple and Meta provided basic subscriber details, such as a customer’s address, phone number and IP address, in mid-2021 in response to the forged “emergency data requests.” Normally, such requests are only provided with a search warrant or subpoena signed by a judge, according to the people. However, the emergency requests don’t require a court order.

Now, it's easy to play Monday morning quarterback on stuff like this. We would probably be even more critical if law enforcement failed to prevent a school shooting because they couldn't log in to one of their 20 vendor portals – or if the tech company took too long to comply.

But at a time when we seem to be moving more in the direction of SMS and email as an authentication mechanism, we should instead be finding innovative ways to solve for strong authentication and user experience.

-Doug