The problem is two factor isn't actually solving most people's problems: That they can't identify a trusted site or message. Everything hence is a gameable acti

The problem is two factor isn't actually solving most people's problems: That they can't identify a trusted site or message. Everything hence is a gameable activity of duping the employee in increasingly more complicated phishing flows. The solution is probably one that modern tech companies absolutely loathe: A modern equivalent to Extended Validation certificates, where trusted activities can be extremely clearly defined to be happening on sites and emails run by plain language companies that have some significant amount of vetting.