the network restrictions surrounding the web authentication service is one layer of defense as was noted this component is too valuable to trust to a single defense