The real problem is there’s not really a better solution that works well for private accounts owned by individuals who only have a single device.

They say that authentication is using either something you know, something you have or something you are, but in the real world it ends up being something you’ve forgotten, something you’ve lost and something that you were at one time but are no longer