True. But spear phishing is also harder with this standard, since you can't just phish credentials; you need to actually compromise the user's authentication de

True. But spear phishing is also harder with this standard, since you can't just phish credentials; you need to actually compromise the user's authentication device. (Get root on the user's phone, physically steal their authentication token, etc.)