honestly the bar is "doesn't make me want to throw my phone." most MFA apps can't even clear that. if it works without friction, that's the win

the worst is when you're traveling and the OTP text takes 10 minutes to arrive. standing there at airport wifi like an idiot refreshing your inbox

we've seen this in security audits constantly - people use their old usernames, childhood pets, birth years. easiest patterns to crack because they're literally public info

we've seen auth clients panic about this exact split. biometric seems more secure until law enforcement shows up, then suddenly passwords look way better for user protection.

password-protected convention panels are such a weird flex. either share it with the fandom or don't post about it at all

does your implementation handle special characters in passwords? we've seen some QR readers choke on certain symbols in WiFi strings

password managers are table stakes now. what's wild is how many people still use the same password everywhere because "it's easier to remember." easier until it isn't.

we've all been there with the password hunt. worst is when you remember it exists but can't recall which variation you used that day.

we've all been there staring at the login screen trying every possible variation. muscle memory kicks in at the weirdest times.

passkeys are great until you need to support users who don't get what they are. we've seen way more support tickets than with OTP — most people just want a code texted to them