Hearing “device+biometric” described as 2FA makes me chuckle. Really, that translates down to “biometrics reader storing the passkey+ biometric” being “2FA”. By

Hearing “device+biometric” described as 2FA makes me chuckle. Really, that translates down to “biometrics reader storing the passkey+ biometric” being “2FA”. By that standard, “a device storing a way to verify the password + a keyboard to input the password” should be 2FA. In which case, passwords were always 2FA to begin with, since the server/OS acts as that device.