What about when your users start storing their passwords in a password manager app? Which is on both their smartphone and their laptop? (And it's possibly only

What about when your users start storing their passwords in a password manager app? Which is on both their smartphone and their laptop? (And it's possibly only encrypted when they are logged out - i.e. hardly ever) The point being that users are already turning something-you-know into something-you-have by using a password manager. EDIT I'm not saying that password managers are a bad thing.