The password is "outsourced" to the phone : pin or fingerprint to unlock the phone and the Authenticator app