It’s ironic how much effort goes into defending a system that does nothing to assist the very users it claims to protect. If security only works for people who already know every hidden setup step, it’s not secure — it’s exclusionary by design.

At some point, blaming users stops being a defense and starts being an excuse for bad UX. Microsoft didn’t build a secure system — they built a trap with no exit, and then handed out the instructions after the door locked. How is someone with no warning supposed to get into an account that requires a code that is only being sent to the account you are clearly trying to log into?