Privacy

Ok, that makes much more sense! I've done a tiny bit of genealogy, so I knew about the exponential numbers, but I misunderstood the sharing. Yes, I know the feature was described as "with relatives" but I was thinking of "with person". Yes, choosing to share with all relatives in one click would produce huge numbers.

As for where to place the blame, it's tough. The vast majority of people have no concept of how this stuff works. In effect, everything from mere typing into a document to logging in to and using network resources is treated quite literally as magic, even if nobody would actually use that word.

That puts a high burden on services to protect people from this magical thinking. Maybe it's an unreasonably high burden, but they have to at least make the attempt.

2FA (the real thing, not the SMS mess) is easy to set up on the server side. It's easy enough to set up on the client side that if that's too much for some fraction of your customer base, then you should probably treat that as a useful "filter" on your potential customers.

There are any number of "breached password" lists published by reputable companies and organizations. At least one of those companies (have I been pwned) makes their list available in machine readable formats. At this point, no reputable company who makes any claims to protection of privacy and security should be allowing passwords that show up on those lists. Account setup procedures have enough to do already that a client-side password check would be barely noticeable.

We know enough about human nature and human cognition to know that humans are horrifically bad at creating passwords on the fly. Some services, maybe most services, should prohibit users from ever setting their own passwords, using client-side scripting to generate random strings of characters. Those with password managers can simply log the assigned password. Those without can either write it in their address book or let their browser manage it. This has the added benefit of not needing to check a password against a published list of breached passwords.

My data will always be at risk of some kind of weak link that I have no control over. That makes it the responsibility of each online service to ensure that the weak links are as strong as possible. Rate limiting, enforcement of known good login policies and procedures, anomaly detection and blocking, etc should be standard practice.