Authentication – when logging in becomes the lock out (seemeplease.com)

This resonates. Auth keeps getting more “secure,” but the failure modes are brutal for real users. We’re great at keeping attackers out and terrible at helping legitimate users recover when something goes wrong.