There's no established meaning of factor. I have trouble understanding UAF goals. We already have full disk encryption + pincodes on laptops and phones. Conside

There's no established meaning of factor. I have trouble understanding UAF goals. We already have full disk encryption + pincodes on laptops and phones. Consider it "first factor" then? If laptop is stolen you cannot get in (see San Bernardino attacks). Yes, everyone must have it "on". So we are left with attacks that control your computer once you unlock it. Malware. And with malware we can exploit your computer right now (no "second factor") or few days later (wait for you pressing that USB button). My point being these both cases are giving same security, but second one is much worse usability. >If its a website that uses password and you get phished this will be completely useless if they don't have access to your U2F authenticater. Pre-condition to this discussion is that "first factor" is not a password but some kind of client certificate, i.e. phishing and reuse is not in question. Then we are looking at what U2F offers us: horrible user experience with most browsers+devices not supporting it for the sake of just delayed exploitation? Thanks, no.