Chapter 1
The anti-lockout mindset: why people lock themselves out
1.1 Learning objectives
After this chapter, learners can:
- Distinguish the risk of being attacked from the risk of locking yourself out (lockout).
- Explain why strong passwords and 2FA can still lead to losing everything.
- Distinguish tactics (MFA, passwords) from strategy (recovery architecture).
- Recognize three common "failure patterns": circular dependency, single point of failure, and simultaneous failure.
1.2 Concepts
What is lockout
Lockout is when the rightful owner no longer has any way into their own accounts or data. There is no bad actor: the system is doing its job of blocking anyone who cannot prove their identity, and the owner cannot prove it.
Three common failure patterns
| Failure pattern | Description | Example |
|---|---|---|
| Circular dependency | Getting into A needs B, getting into B needs A | The password manager's 2FA code is stored inside the password manager itself |
| Single point of failure | One device or account holds the keys to everything | A single phone holds all authenticator apps |
| Simultaneous failure | Many things fail at once from the same cause | Resetting every device in one evening to "clean up" |
Tactics and strategy
- MFA (multi-factor authentication) is a tactic. It answers "how do I lock the door tightly?", protecting each login with something you know, something you have, something you are.
- Recovery architecture is strategy. It answers "when things gradually break, what can still rescue what?".
- The stronger the MFA, the more you need an exit. A steel door without a spare key is a trap.
1.3 Worked example
Mr. A is an engineer who uses a password manager, enables 2FA on every account and uses end-to-end encrypted email. One evening, suspecting malware, Mr. A resets both his laptop and his phone at the same time.
- The authenticator app (holding the 2FA codes) was on the phone: gone.
- The password manager's 2FA code was stored inside the password manager itself: cannot open it.
- The main email recovers via the secondary email, the secondary email recovers via the main email: both demand 2FA codes.
- The "backup" data in the cloud was a synced folder, deleted along with everything when Mr. A cleaned his machine.
Conclusion: there was no attacker. Mr. A had plenty of strong security tools, but his architecture had no exit. This is not a technical error; it is an architectural error.
1.4 Common mistakes
- Thinking "more security layers means safer" without asking how each layer is recovered.
- Cleaning up, resetting or mass-changing passwords while panicking.
- Believing the cloud "backs up automatically" for you.
- Assuming you are someone who never forgets and never loses a device.
1.5 Checklist
1.6 Exercises
- Draw a diagram: each important account is a box, arrows point to "is recovered by". Find the circles.
- Write out the scenario "I lose my phone tonight". What can you still get into tomorrow morning?
- Discuss: why are humans the weakest link in recovery, not just in attacks?
1.7 Summary
- For most users the biggest risk is locking themselves out, not hackers.
- MFA is a tool; recovery architecture decides whether the system lives or dies.
- A good system does not require a perfect human.