After 3 weeks in Maryland, my computer doesn’t know who I am. Neither do I.

There are things people tell you about moving. They tell you about the boxes. Lord, do they tell you about the boxes. They tell you about changing your address with the post office, updating your driver’s license, finding a new dentist, locating the nearest grocery store, and figuring out which neighbors wave back and which ones are going to be a whole situation. People have opinions about moving, and they will share every last one of them with you.

Nobody — not one single soul — warned me about two-factor authentication purgatory.

I did not see that coming. I was prepared for culture shock. I was prepared for the moment I asked for sweet tea and got a look like I’d requested something from a foreign language menu. I was not prepared to spend a meaningful portion of my first weeks in Maryland locked out of my own digital life because every service I use on the internet noticed I was logging in from a new location and collectively decided I was a criminal.

Google was the worst offender. Last week, Google made me verify my identity by password. Then by their authenticator app. Then — and I want you to understand I am not exaggerating here — a third time, by text message. Three times. For Google. Which I have been using since approximately the second Bush administration. Google, which knows my search history, my location history, my email, my calendar, my browsing habits, and almost certainly my hopes and dreams, looked at me logging in from Maryland and said, “We don’t know you, friend.”

I have given Google more personal information than I have given my own mother, and they wanted to see some ID.

It wasn’t just Google. Every service I use had the same reaction. Banks. Streaming services, social media, and every website I use to do business every day.. All of them saw a Maryland IP address and went to high alert. I half expected my refrigerator to send me a verification code.

Now, I want to be fair here. I understand the impulse. Security matters. People get hacked. Bad actors exist. I am not arguing against the concept of protecting accounts. I am a reasonable man — I think. I have been told this by at least two people.

What I am arguing is this: if we as a society have collectively agreed — and we have, the tech people have been saying this for years — that passwords are no longer secure, then why in the name of all that is holy are we still using them as the first step? If the password is the part that doesn’t work, and the phone verification is the part that does work, then the password is just a speed bump on the way to the phone verification. It is a formality. Red tape — and we all know how journalists like myself feel about red tape. It is the “how are you” of cybersecurity — technically required, not actually doing anything.

Pick a lane, Tech Bros. Either passwords work, in which case one of them ought to be sufficient, or they don’t work, in which case stop asking me for one and just send me the text. What we have right now is a system that doesn’t trust passwords but also won’t let go of them, which is the technological equivalent of a man who doesn’t trust his GPS but also owns a map from 1972. You’re just going to sit there at the intersection, suspicious of everything and going nowhere.

I have now updated my location in approximately forty-seven accounts. I have been locked out of six. I have reset passwords for nine. I have discovered two accounts I forgot I had, one of which was for a service I genuinely cannot identify and am now slightly afraid to cancel in case it’s doing something important.

The Woman Who Shares My Name has been watching this process with the patient expression of someone who has been married to me long enough to know that the best thing to do is let it run its course.

“You could just call them,” she said.

“I am not calling them,” I said.

“Why not?”

“Because then they’ll want to verify my identity.”

She went back to her book.

I’ll get it sorted eventually. In the meantime, if you’re trying to reach me digitally and I seem slow to respond, I am probably in an infinite verification loop somewhere, proving to a server in a data center in Eastern Zimbabwe that I am, in fact, me.

Which, after three weeks in Maryland, is a question I’m still working out myself.

Enjoy this column?
There’s a whole book like this.

Buy the Book on Amazon →