> As it is often just protected by a username and password the argument is that it's the same "something you know" factor as a password, or just an obfuscation of the same factor.

All factors are just varying obfuscations of "something you know" when you get down to it though.