Agreed. I think the main new vector is a "new device". So having the user approve on an old device (where possible or otherwise use 2FA) would prevent most of t

Agreed. I think the main new vector is a "new device". So having the user approve on an old device (where possible or otherwise use 2FA) would prevent most of the log in attacks. It also removes the attack of "look under the mouse pad" where bribing a cleaning person gets you a whole company's user logins.