to be clear i think we can basically agree on the fundamentals: the FFIEC guidelines where two or more of the three basic auth factors are used in combination (biometrics, usernames, and passwords are independent) and our argument is really about the best way to help everyone else who can only see 2 categories. this was fun.