Can we decide to band together as an industry and call this “zero factor authentication,” since you login without using something you know or something you own/control?
The only way I can think of to explain this to a non-techie is “your account is now tied to your [singular] device, and neither a password nor a replacement device (like a new sim card) will let you in.”
So, it really does remove both factors from 2FA, and the logical conclusion holds.
Either anyone can get into an account with a “I broke my phone” social engineering attack, or the account owner cannot reliably authenticate.
The only way I can think of to explain this to a non-techie is “your account is now tied to your [singular] device, and neither a password nor a replacement device (like a new sim card) will let you in.”
So, it really does remove both factors from 2FA, and the logical conclusion holds.
Either anyone can get into an account with a “I broke my phone” social engineering attack, or the account owner cannot reliably authenticate.