When Security Depends on a Single Device
Yesterday was a reminder of how fragile some of our most relied-upon systems actually are.
A service outage meant text messages didn’t reliably come through. In practical terms, two-factor authentication codes never arrived. Accounts couldn’t be accessed. Work stalled — not because credentials were wrong, but because the delivery mechanism failed.
In theory, two-factor authentication increases security. In practice, when it depends on a single device and a single channel, it can introduce a different kind of vulnerability.
I use authenticator apps for many accounts. I also sometimes rely on text-based codes because they are quick and widely supported. But as anyone who uses internet-based phone numbers or travels internationally knows, SMS-based authentication isn’t always dependable — especially when services are disrupted or numbers don’t behave like traditional mobile lines.
What struck me most wasn’t just the inconvenience. It was the way the system forced a context switch.
Regaining access usually requires reaching for a phone, which immediately reintroduces notifications, messages, and ambient noise — even on days when active use is minimal. During yesterday’s outage, that reliance became more apparent. The device was checked repeatedly for codes that never arrived, while its battery continued to drain, highlighting how much background activity persists even without meaningful engagement.
There is growing research showing that mobile phone use fragments attention and increases cognitive load, particularly when interruptions are frequent and unplanned. The cost isn’t just momentary distraction; it’s the gradual erosion of sustained focus over time.
This is the deeper tension I keep coming back to.
We design security systems that assume constant device availability. At the same time, many of us are actively trying to be more intentional about how and when we use those devices — for focus, for presence, and for the ability to stay on task. The result is a system that protects accounts while quietly undermining attention.
This tension becomes even more pronounced for students and young adults.
College students studying abroad often lose access to U.S.-based phone numbers. Text-based authentication fails. Backup methods haven’t been configured. Account recovery becomes complicated precisely when independence is supposed to increase. What feels like a minor oversight at home turns into a significant barrier elsewhere.
At the same time, there is a growing movement toward more mindful and intentional phone use, not through bans, but through structure. Approaches that emphasize boundaries, awareness, and deliberate engagement — rather than constant availability — are increasingly recognized as sustainable ways to reduce habitual distraction. This broader conversation is grounded in data. Surveys indicate that Americans now spend more than five hours per day on their phones, and many express a desire to cut back on usage. Research also suggests that excessive smartphone use can disrupt memory and reduce focus, particularly when use becomes habitual rather than intentional. Among students and young adults, recent evidence links heavy smartphone use to both cognitive and psychosocial effects, underscoring how closely attention, emotional regulation, and technology use are intertwined.
A few years ago, we made a modest household decision: phones don’t belong at the dinner table.
It wasn’t about discipline or nostalgia. It was about protecting a narrow window of shared presence — time that didn’t need to be optimized, documented, or interrupted. That decision has held, even as work has changed. Even in environments that occasionally require rapid response, it’s usually possible to step away briefly. The result isn’t perfection. It’s intention.
When we need to plan — meals, schedules, logistics — we often start with tools that feel almost like we are still in last century: paper, a whiteboard, a pen. These tools do something deceptively powerful. They hold complexity without competing for attention. They allow multiple people to see, contribute, and adjust without pulling anyone into a private digital space. Only later do we translate that thinking into digital systems.
In Jewish tradition, intention matters. Kavanah is not only about what we do, but about how we structure the conditions that make meaningful action possible. Boundaries around time, space, and tools are not limitations; they are enablers. Paper planning at a table is not a rejection of technology. It is a way of saying: this moment deserves a different kind of container.
I’ve been thinking a lot about approaches that don’t involve banning devices, but contextualizing them:
-
Verbalizing intention before picking up a phone (“I’m using this for one task.”)
-
Setting aside regular device-free time — something Jewish life already models well with Shabbat.
-
Using and actually honoring app time limits, especially for platforms designed to pull attention sideways.
From a systems perspective, this matters.
Protective mechanisms are not neutral. They shape behavior. They pull people across devices. They interrupt concentration. And they assume levels of infrastructure stability that don’t always exist, especially across borders, carriers, and time zones.
This isn’t an argument against two-factor authentication. It’s an argument for designing it with redundancy, context, and human behavior in mind — particularly for families and organizations preparing young adults for independence.
That reality became especially clear as our school reminded families that many seniors will be abroad over the next several months. College applications that rely on text-based two-factor authentication tied to U.S. phone numbers can create unexpected barriers, not only to receiving acceptances, but also to accessing critical financial aid and scholarship information at a pivotal moment in the decision-making process.
Security should protect access.
Security should protect access.
Good design should protect attention.
As phones increasingly function as authentication tools, communication devices, and attention hubs, the way we design security systems has consequences well beyond cybersecurity. We don’t need to choose between security and presence — but we do need to acknowledge the tradeoffs when we ignore how systems actually get used.
