Sign Up or Get Out: The Website Account Racket That's Making You Less Safe

Remember when you could just buy a pair of socks online? You'd find the socks, click the socks, pay for the socks, and the socks would arrive at your house. No account required. No verification email. No push notification asking you to confirm your identity on a separate device. Just socks. Transaction complete. Everyone goes home happy.

That era is dead. It has been buried, eulogized, and paved over with a modal dialog asking you to "create a free account to continue."

The Toll Booth at the End of Every Road

Somewhere in the mid-2010s, the internet collectively decided that anonymous browsing was a problem to be solved rather than a feature to be preserved. Retailers wanted purchase histories. Publishers wanted demographics. Apps wanted engagement metrics that only make sense if they can attach behavior to a persistent identity. The account wall wasn't born from security concerns — it was born from a spreadsheet.

And yet the industry dressed it up in the language of safety. "Protect your purchase history." "Keep your preferences secure." "Sign in for a personalized experience." What they meant was: we need to log your behavior across sessions so we can sell ads and tell investors we have 40 million monthly active users.

The result is a web where you cannot read a news article, check a recipe, download a free font, or submit a customer support ticket without first surrendering your email address to a company whose privacy policy is longer than Moby Dick and approximately as fun to read.

"Just Sign In With Google" Is Not the Shortcut It Looks Like

The tech industry's answer to account fatigue was federated login — the little "Continue with Google" or "Sign in with Apple" buttons that promised to simplify everything. And in a narrow, click-count sense, they did. One tap and you're in. No new password to forget.

But here's what that button actually does: it hands a third party — Google, Apple, Meta, whoever — a real-time log of every service you authenticate with. Every time you tap "Continue with Google," Mountain View gets a timestamp, a service name, and a data point about your behavior. You traded password friction for surveillance convenience, and you did it willingly because the alternative was filling out another CAPTCHA.

Worse, you've now created a single point of catastrophic failure. If your Google account gets compromised — through a phishing attack, a credential stuffing breach, or just a really bad Tuesday — every service you linked to it falls like dominoes. You didn't reduce your attack surface. You concentrated it.

The Verification Stack That Never Ends

Let's talk about modern authentication flows, because they have become genuinely surreal. You create an account. You verify your email. You set up two-factor authentication via SMS. Then the app asks you to also install their authenticator. Then it wants you to verify your phone number again in case you lose access to the authenticator. Then it sends a backup code to your email. Then it asks if you want to add a recovery phone number different from your primary phone number.

At some point you are no longer securing an account. You are assembling a cryptographic Rube Goldberg machine to access a website that sells artisanal hot sauce.

The irony is that SMS-based two-factor authentication — the kind most sites default to — is genuinely weak. SIM-swapping attacks, where a criminal convinces your carrier to transfer your phone number to their device, are common enough that the FBI has issued warnings about them. The security theater of texting you a six-digit code is exactly that: theater. It makes the website's security team feel better. It does not make you safer.

Passwords Everywhere, Security Nowhere

Here is the number that should keep every security professional awake at night: the average American has somewhere between 70 and 100 online accounts. Seventy. To one hundred. Accounts. For a species that struggles to remember where it put its keys.

The predictable result is password reuse on a massive scale. People pick one or two passwords they can actually remember and rotate them across dozens of services. When one of those services gets breached — and they get breached constantly; check haveibeenpwned.com if you want to ruin your afternoon — those credentials get fed into automated tools that try them against every major platform within hours. This is called credential stuffing, and it works embarrassingly well precisely because the account-everywhere model forced people into impossible memory demands.

The websites demanding you create accounts in the name of security are, in aggregate, the primary reason your security is compromised. They created the conditions for the problem they claim to be solving.

Friction Is the Feature

Here's the part the UX teams will never say out loud: the friction is intentional. Not the security friction — that's often just negligence dressed as diligence — but the account-creation friction specifically.

When you create an account, you are more likely to return. You have sunk cost now. You have a purchase history, a wishlist, saved preferences. The account is a retention mechanism. The login wall isn't a door with a lock; it's a roach motel. You check in, and checking out requires navigating to a settings page that's been deliberately buried four levels deep next to an unsubscribe button that sends you a confirmation email you have to click to complete the process.

This is not a conspiracy theory. It is a documented product design philosophy. "Reducing churn" is a KPI. Making your account easy to delete works directly against that KPI. The math is not subtle.

What Secure Actually Looks Like

Passkeys — the authentication standard backed by Apple, Google, and Microsoft — represent a genuine attempt to fix this. They use cryptographic key pairs tied to your device, which means there's no password to steal, no SMS code to intercept, and no phishing page that can capture your credentials. They are meaningfully better than everything the current system does.

They are also still not widely supported, inconsistently implemented, and largely invisible to the average person who just wants to buy socks.

Until passkeys become the default rather than the exception, we are stuck in a system where every website wants to be your password manager, none of them are good at it, and the collective weight of a hundred accounts is a security liability you're expected to manage personally while also living your life.

The internet asked you to sign up for everything. The internet did not hold up its end of the bargain.