[HopenHeyHi]

> Just to clarify, these "normal people", they are the ones who typically click on links in phishing emails without actually thinking?

Yes? Heh, you know what normal people means, good. Guess what, phishing emails tricking people into visiting fake websites won't be as effective as with this flow there is no password for them to type in and accidentally give away to the attacker.

> Q: Why would one not expect to have devices sequestered from each other?

Because most people don't carry two phones or bother sequestering devices. It isn't the common case so it isn't a polished flow. At least not yet.

Don't know about a mountain as you probably use a password manager already, it isn't much different.