I just think they should be able to opt out. Its up to the patient what their security posture is. If they don't want it, they shouldnt be forced to have it. Just have them sign away their rights to sue the hospital or something along those lines.

I'm open to hearing an argument why it should be forced to use MFA even if the patient doesnt want it. I know at least one hospital my company works with that has it optional for patients who want it.

MFA doesn't really help much in the case of a tech illiterate person though, since TOTP codes can be phished just like username and password can. A scammer that calls them will just ask for the code in addition to the username and password.

My employer uses Yubikeys with FIDO2/WebAuthn for two factor auth, but that's probably too complex for a non technical person to figure out (even if it's basically just "press the button when it tells you to").

It's a balance in many ways. There's some aspect of refusing to do things due to not wanting to learn things. But sometimes people don't want to adopt technologies simply because they're unwilling to accept some very glaring downsides. For example, if you demand 2FA, you are demanding that your customers essentially consent to have an ankle monitor and remote audio monitor on their person at all times. Smart phones track your location 24/7, and they seem to track what is spoken around them as well. They are absolutely a huge invasion of privacy, and it's remarkable we ever let them become as indispensable as we have. They're basically just ankle monitors we all voluntarily put on each morning. I can absolutely see people just refusing to have a smartphone for the privacy implications alone.

I also have some red lines on technology. I refuse to use tiktok because of its privacy and psychological manipulation issues. And I've moved away from most social media, even if that cuts me off from some very useful communications and conversations in my family and community. I also refuse to buy any appliance with a wifi connection. I try to avoid any device that requires an app to use. If your widget requires an app but your competitor's doesn't, I'm buying from your competitor. If your widget requires an app and your widget is just something that would be nice to have, but not life-changing, I'm not going to buy your widget at all.

It's a very dangerous thing to simply decry anyone who rejects a technology as ignorant or not tech-savvy. Often people reject particular technologies for damn good reasons. If we just accept the newest thing with zero thought simply for the fact that it is new, we are actually the ignorant ones. Something being newer does not automatically make it better. And often newer things are inferior to old things, like the case of a lot of privacy-violating appliances and companies filling everything with DRM and trying to turn it into a subscription. I don't want basic household items to require an app to use, as it is guaranteed that the security on that system will be crap, and that the product will stop working after a few years after the company stops supporting the app.

If I'm buying a physical thing, I want it to be completely stand-alone and require zero continued feedback from its manufacturer in order to continue to function. You can tell me til you're blue in the face about how spying on me helps improve the customer experience, but I'm still going to tell you to take your privacy-violating, app-dependent widget and shove it up your app-loving ass.

The difference is you. You enabled him and helped accommodate his needs. Without you, how’s he going to cope? Also you’re a good child.