Security vs Usability
A trade-off that is usually resolved by varying the control with the value of the action, rather than by choosing a uniform level of friction.
Uniformly high friction produces workarounds — shared accounts, written-down codes, abandoned sign-ups — which often yield a worse security outcome than the moderate control they replaced. Uniformly low friction leaves high-value actions unprotected. Neither pole is right, and treating it as a dial to be set once is the mistake.
The architectural resolution is step-up authentication with risk-based access. Authenticate at a baseline; require stronger proof at the moment a consequential action is attempted — adding a payee, exporting data, changing production configuration. Users accept friction they can see the reason for, and most sessions never encounter it.
Make the baseline risk-aware: known device, known location, recent authentication and normal behaviour justify a lighter touch than a new device from a new country.
The genuinely useful observation is that the trade-off is sometimes false. Passkeys are both stronger than SMS or TOTP and lower friction — a biometric instead of typing a code from another device. Where a technology moves both objectives in the same direction, the trade-off dissolves rather than needing to be balanced.