They're outsourcing the password to phone : pin or fingerprint to unlock the phone and the authenticator app