If a bridge collapses because too many cars drive across the bridge, we do not blame the drivers. We do not hold press conferences to discuss the moral failings of the commuters. We do not send the drivers to mandatory training sessions to learn about weight distribution and structural load.
We blame the engineers. We blame the materials. We blame the system that allowed a fragile bridge to be built in a busy place. The bridge is a tool. The tool failed to do the job.
In the world of digital security, the logic is different. When a system fails, the industry looks at the person using the system. The industry calls the person the weakest link.
This is a strange way to describe a customer. It is a strange way to describe a human being.
The Cathedral and the Clock
I gave wrong directions to a tourist yesterday. The tourist wanted to find the old cathedral. I told the tourist to walk three blocks and turn left at the fountain. There is no fountain. There is a statue of a horse.
I realized my mistake later. The tourist was gone. The tourist was walking toward the docks. I felt a small pang of guilt. I am a disaster recovery coordinator. I should be good at directions. I should be good at systems.
But I am a person. A person makes mistakes. A person remembers a fountain when there is only a horse.
7:14 AM on a Saturday
Tom is a person. Tom is . Tom owns a landscaping company. Tom has four employees. Tom has two trucks. The trucks smell like damp mulch and gasoline.
It is on a Saturday. Tom is sitting in his truck. Tom is outside a garden-supply wholesaler. The wholesaler has a new ordering portal. The portal is supposed to make things easy. Tom wants to stop phoning in orders. Tom wants to see the inventory on his phone.
The portal asks Tom to create an account. Tom enters his name. Tom enters his email. The portal asks for a password. Tom types ‘Greenway2024’. Tom likes this password. It is easy to remember. Greenway is the name of his company. is the year.
Access Denied
Password needs a symbol. Password cannot have repeated characters.
The portal rejects the password. Tom adds an exclamation mark. ‘Greenway2024!’. The portal rejects the password. The portal says the password cannot have repeated characters. Tom looks at the word. The word ‘Greenway’ has two ‘e’s. Tom sighs.
He tries ‘Gr3enway2024!’. The portal rejects the password. The portal says the password must be twelve characters long. Tom is tired. The guys are waiting in the second truck. The guys want to get to the job site.
Tom types the password he uses for his bank. He types the password he uses for his fantasy football league. He adds a hash mark and the number one. ‘Football#1’.
The portal turns green. The portal is happy.
Tom is not happy. Tom feels a small amount of guilt. Tom knows he should not reuse passwords. Tom has seen the news. Tom has heard the warnings. But Tom needs to buy mulch. Tom needs to start the day.
Industry Hygiene
The security industry looks at Tom and sees a problem. The industry sees a person who lacks discipline. The industry writes reports about people like Tom. The reports say that 81% of data breaches are caused by poor password hygiene.
Industry reports attribute the majority of breaches to “poor hygiene”-a personal failing rather than a design flaw.
The reports use words like ‘hygiene’ to make the failure sound like a personal mess. If you do not wash your hands, you get sick. If you do not create unique passwords, you get hacked. The blame stays with the person.
This is the industry grading its own homework. The industry designed the password system. The industry created the requirements. The industry knows that a normal person has ninety-seven different digital accounts.
The industry knows that no human brain can store ninety-seven unique, complex, random strings of text. When the person fails to do the impossible, the industry calls it a ‘human factor’ error.
A system that relies on a person never making a mistake is a broken system. I sent that tourist to the docks because my brain failed. If the city wanted people to find the cathedral, the city should have put up a sign.
A sign does not rely on my memory. A sign is part of the environment. When we blame the user, we stop looking for better solutions. We spend money on ‘awareness training’. We tell employees to watch videos about phishing.
We tell them to be more careful. We tell them to be more suspicious. We treat security like a character trait. We act as if a person can be coached out of being a human.
Building a Better Bridge
The shift toward new technology is an admission of this failure. We are seeing more sites use passkeys. We are seeing more sites use one-time codes sent to a phone. We are seeing magic links.
These tools do not ask Tom to remember anything. These tools do not ask Tom to be a computer. They ask Tom to have his phone. They ask Tom to have his fingerprint. This is a design choice. It is a choice to build a better bridge.
Taking Responsibility:
Software like HMDIA allows site owners to change how people enter the system. A site owner can choose to stop asking for passwords. A site owner can use a magic link. A site owner can use a passkey.
When the site owner makes this choice, the site owner is taking responsibility for the bridge. The site owner is saying that Tom should not have to feel guilty in his truck at .
The industry likes the password model because it is cheap for the industry. The burden of the password stays with the user. The user has to remember the password. The user has to reset the password. The user has to feel the shame when the account is compromised.
If the industry moves to better authentication, the industry has to do the work. The industry has to write the code. The industry has to manage the complexity.
“The system blames the person for having a memory and calls the count a security report.”
I think about the tourist. I wonder if the tourist found the docks and felt stupid. I wonder if the tourist thought they had missed the fountain. The tourist probably blamed their own sense of direction.
People are very good at blaming themselves. We are taught to apologize when we trip over a crack in the sidewalk. We do not look at the sidewalk and ask why it is broken. We look at our own feet.
A Security Ritual
The math of the password is cruel. If you change your password every , as many corporate systems require, you are asking for even more failure. You are asking a person to overwrite a memory with a slightly different memory.
“This is not security. This is a ritual. It is a dance we do to satisfy a requirement.”
We have turned security into a performance. We check the boxes. We meet the character requirements. We include the symbol. We do all of this to make the little red box turn green.
We are not actually making the system safer. We are just making the system accept us. We are trying to get through the door so we can do our actual work. Tom does not care about the portal. Tom cares about the mulch. Tom cares about the four employees who need to be paid.
When a person is forced to choose between a complex rule and their actual job, the job wins. Every time. This is not a lapse in judgment. It is a rational choice. The job is real. The mulch is real. The password requirement is an abstract hurdle.
If the hurdle is too high, the person will find a way around the hurdle. They will write the password on a sticky note. They will save it in a plain text file. They will use the same password they used in .
The security industry calls this ‘shadow IT’ or ‘user negligence’. I call it survival. People are trying to move through their lives. They are trying to navigate a world that is increasingly crowded with digital gates. Every gate wants a secret word. Every secret word has a different set of rules.
A Return to Humanity
We need to stop asking people to be better at being machines. We are not machines. We are forgetful. We are tired. We get distracted by statues of horses when we are looking for fountains.
A good system is a system that understands this. A good system is one that protects the person even when the person is in a hurry.
The move toward passwordless login is the most honest thing the security industry has done in . It is an admission that the old way was a mistake.
It is an acknowledgment that the ‘weakest link’ was actually a person being asked to do something impossible. When we remove the password, we remove the guilt. We remove the friction. We allow Tom to order his mulch and get to the job site.
I hope the tourist found the cathedral. I hope they didn’t walk too far. Next time someone asks me for directions, I will check my phone first. I will not trust my memory. My memory is a human memory. It is full of holes and horses that look like fountains.
I will use a tool that was designed to be accurate. I will take the burden off my own brain. That is how you avoid a disaster. You build a system that knows you are human.
You build a bridge that can hold the weight of the cars. You stop grading the users and start grading the design.