Each financial institution I use has its own unique password; I wish I had so many billions those passwords were inconsequential. However, I am not convinced their complexity is the key to my security - just that they are different. And I get the, “but what about the other people who use the same one?” Those people need to be balanced against the people who do practice some common sense. There are times when you need to structure your UX for the lowest common denominator, but I don’t think this is one of them. A security structure that encourages people to write down their passwords in the least secure medium possible is like a transportation system that slows down with an increase in traffic: an oxymoron.
You can craft the most concise, clear and unambiguous user message and people still stare at it and ask, “what do I do?” In a world where the majority of people still haven’t caught on to the fact you have to first read the message, second understand the meaning of the words, third understand the meaning of the words in the order they are displayed and then finally do what the words are asking you to do, I don’t agree that making me have a secure password for a site with no credit card, personal information or any other knowledge about me is appropriate.
What they are going to learn from me is that I use a lot of profanity in my passwords when I am forced through a long sign-up process for something I will use once. For passwords I use routinely, I use a different methodology.
And I am completely in agreement with you on multi-factor authentication (MFA). If on the other hand, banks are suddenly into Masters of Fine Arts, then I have some quibbles about the MFA only one of which is the cost.
