I agree that it works for security-sensitive institutions with their own IT/security staff who can re-enable accounts if there's been a mistake. In contrast, w

I agree that it works for security-sensitive institutions with their own IT/security staff who can re-enable accounts if there's been a mistake. In contrast, what do I do if I get locked out of my personal computer? Either it's time-based and I have to wait 15 minutes to log in again, which is unacceptable, or I have to call my OS vendor, which is impossible. Even for ordinary employees at ordinary companies, the IT burden from false positives would be prohibitive. In an organization with sensitive or classified data, false positives when someone is unusually stressed or acting abnormally could be a benefit. The government would want to know about someone exhibiting unusual behavior when accessing classified information, even if they're not an impersonator. The problem with multiple factors (other than real biometrics) is that they're not independent. If I'm stressed or mad or tired, my behavior is likely to fall outside of the parameters for most of the checks -- keyboard timing, mouse behavior, window switching or menu navigation -- not just one of them. Even something as simple as the article's suggested creditcard.txt honeytrap won't work reliably. If I access it, maybe I'm Mallory, or maybe it's been 3 years since I set it up and I forgot it was a honeytrap. It wouldn't work inside a VM, either. You can't lock someone out when they have the ability to snapshot the entire OS below the level of the authentication system. Finally, there would be no way to help someone else with a computer problem, because they'd almost certainly get locked out.