I&#x27;m not up to date on terminology to do with two-factor authentication, but shouldn&#x27;t it be &quot;currently possess&quot; rather than &quot;own&quot; the resource or device in question? It is important to remember what can go wrong and invalidate the assumptions of the protocol, e.g. theft or duress.