Mildly Infuriating

It sounds like your bank is doing MFA (multi-factor authentication) correctly, and that’s a good thing, because it sure would be obnoxious to have to verify all that information just to view your balances, and it’s a higher risk activity to allow someone to transfer funds than to view your balances.

If the dealership didn’t verify your identity and someone else made changes to your lease, would you have a problem with that?

You don’t have to use an authenticator on your phone. You can use a password manager like Bitwarden (their $10/year premium plan, or their $40/year family plan) that supports saving TOTP and auto-filling them from a browser extension (click to copy or you can have it automatically copied to the clipboard after you auto-fill the password). It also supports passkeys and you can avoid getting locked into a single ecosystem that way.

On the matter of information security, but also security in general:

• convenient
• effective
• inexpensive

Pick two.

I'm surprised you're getting downvoted so heavily: Is it really that controversial of an opinion that I want to be able to make the choice between reliable accessibility, efficiency, and hardened security for my personal stuff?

Of course: On a corporate network I have a responsibility to have a very secure account so that I'm not a weak point, I'm not talking about scenarios where my account being breached exposes others that I'm responsible for.

I'm talking about my personal accounts. I may want to choose to have a password and no 2FA, for the simple reason that I may want to be able to access my account from a library computer or internet cafe without having access to any of my devices. That reliable access may be more important to me than having heavier security, and nobody has any business asking me why, because it's my data that I'm choosing how to protect. However, that's become pretty much an impossibility by now, with everyone shoving 2FA and whatnot down my throat, regardless of what I want.

If I happen to lose/break my laptop and phone simultaneously, which is not unthinkable given that I carry both on me pretty much every day, I'm pretty much locked out of everything.

It's interesting that you're getting downvoted. There's plenty of evidence that things are getting worse in this field, not the least of it caused by ignorant policymakers who are hellbent on protecting their arse by being seen to be doing something, anything.

Then there's the ambulance chasers who amplify the fear factor up to eleven just so they can justify their retainers.

Finally, there's Microsoft who in my opinion shows the whole world, time and again, how not to do security whilst all the while preaching to its victims, uh, customers, what "best practice" looks like, whilst chanting"Do as I say, not as I do".

Security is about education above all else. The vast majority of breaches start by social engineering, getting a target to inadvertently install something or reveal something that gives an attacker a toehold into a system. It might be an unexpected PDF, a clicked link, a weak password, or personal information retrieved from someone who has no business storing your passport and driving licence on a system.

I just feel like they verify it in the dumbest ways. I'm tryna log into Outlook from my phone and the verification goes to... my phone. Clearly whoever is breaking into my phone app has my phone!

Also my banking app is coded stupidly.

You login, it asks the fingerprint, then it asks "do you want to allow login to user xxx"?

Then don't sign in