Too Secure for Their Own Good

The Uncanny Adventures at Geek Squad: Too Secure for Their Own Good Edition

Yesterday, I talked about the “A” in the CIA triad—Availability.

Today’s story ties directly into that.

For many older clients, the biggest issue isn’t malware, hackers, or data breaches.

It’s simply getting locked out of their accounts.

They don’t use password managers, they don’t understand passkeys—they just want their accounts accessible with a password they can remember and a reset option that doesn’t feel like a mission from MI6.

Don’t get me wrong:

MFA is amazing.

Email + password → verification code → done.

It’s secure and user-friendly.

But here’s where things start slipping into “security theater” territory:

This week I helped multiple older customers reset their Apple or Google accounts, and the process was… something:

 • 24-hour waiting periods

 • MFA

 • Authenticator apps

 • Codes sent to phone AND email

 • Recovery device codes

 • Captchas

 • “Enter your last known password”

 • Strict password policies

 • Additional verification prompts

In theory, each layer strengthens security.

In practice, it often destroys availability—and ramps up anxiety for the very people we’re supposed to help.

Security doesn’t work if the user can’t use it.

As cybersecurity professionals, we can’t just chase “more secure.”

We have to balance risk, usability, and availability.

If people feel overwhelmed, they won’t feel secure—they’ll feel punished.

And when security becomes an obstacle rather than a safeguard, that’s when we’ve gone too far.