> The first factor is the password, but the second factor is the device's lock screen / password. > I enquired how did they know a lock screen was actually set

> The first factor is the password, but the second factor is the device's lock screen / password. > I enquired how did they know a lock screen was actually set up, let alone solved recently, and the answer was: "on Android, we know - for Windows & macOS, we'd probably need browser extensions". This blew my mind. How many Google security experts worked on their model and how did they all think "...and obviously we can assume every user has a secure login set up on every machine"?!