> They just need to make sure they have a backup device and/or offline recovery options available. There's the hard part. Go to the World of Warcraft forums

> They just need to make sure they have a backup device and/or offline recovery options available. There's the hard part. Go to the World of Warcraft forums and ask how many people have had trouble dealing with identity verification with Blizzard because they lost or destroyed their phone and no longer have access to the Blizzard Authenticator app and are therefore locked out of their account. Sure, the app will give you backup codes you can use to restore the Authenticator on a new device, but clearly very few people are actually recording those somewhere. > Developers screw up password hashing constantly. Developers should know better. There's no excuse for continuing to use poor/no hashing for password storage. > Malicious actors should grow to strongly dislike this approach. Not as much as you think. Considering how many people still think that fingerprints are secure, if stealing someone's device means having access to everything they have, then "your device is your password" is flawed. PINs and swipe patterns are trivial to shoulder surf.