I agree. I meant to say that you can no longer just have "something you know", you also need "something you have". Wether this is already or not 2FA it's a bit

I agree. I meant to say that you can no longer just have "something you know", you also need "something you have". Wether this is already or not 2FA it's a bit debatable. Apple says yes and I tend to agree. From the server's perspective, however, it can only verify 1 factor and it has to trust the client to implement the 2nd factor securely (whether it's a pin, fingerprint, face id, etc.)