There is one thing that annoys me almost every time.
It is 2FA.
QR.
Authenticator.
TOTP.
I need to sign in to a service. Ok.
First:
- “So, where is the password?”
- “Password manager? Which one?”
- “Or did I change it at some point?”
… Sign in …
Oh no.
Right… there is also a code.
So:
- I look for my phone
- I open the app
- I enter the code
I calm myself down:
At least my account is secure.
And every time there is a small but persistent micro-negative feeling.
Even though I perfectly understand why this exists.
Over time, this micro-negative feeling starts to stick to the service itself.
At every login.
Which is usually a good signal that something in the flow is broken.
Password + 2FA is secure. But why exactly like this?
Yes, password + 2FA increases security.
But I keep asking myself:
- Why exactly this implementation?
- Why two completely different mental flows?
- Why should users suffer in order to be secure?
The problem is not security.
The problem is the entry experience.
Password-first flows force the user to:
- think about credentials
- then suddenly switch context
- and only then deal with the second factor
This context switch happens every single time.
What if the flow was simpler?
- the password is removed as an unnecessary layer,
- only one clear, predictable login flow is left,
- and all the “hard” security work is pushed under the hood?
Something like:
1FA (authenticator-only)
- strict rate limiting
- replay protection
- binding to the login attempt
- context-aware checks
No extra steps.
No surprises for the brain.
This line of thinking is exactly how Toqen was born.
How it feels in practice
The actual experience becomes:
I take my phone.
I open the site.
I enter the code.
Done.
Calm.
Security is still there.
But the friction is gone.
Unusual at first? Yes.
But it turns out you get used to convenience very quickly.
Top comments (0)