Security doesn’t (always) have to be… so fucking annoying

It just doesn’t have to be like this. It just doesn’t. I care about the experience of the people using a product more than anything else – yes, even more than security. As I wrote elsewhere, if you have the best system in the world but it makes customers want to kill themselves while using it, then you don’t have the best system in the world. Security that makes people miserable, while doing nothing to attackers, is the antithesis of everything I care about. I forgot my OLX password, used the reset form, and it said it’d send me a code. I filled it in: “Forgot your password? Which e-mail is associated with your OLX account? Where should we send the code?” (translated from Polish) and got this: “Check your e-mail. We’ve just sent a confirmation link to o***@j***” o***@j***. Nice! My email address is safe from … me? How does this type of “security” get implemented? The masked version is literally generated from what I just typed, so it can’t reveal anything that I didn’t already know…