Back again with more questions about how the rules are intended to work. On page 253 of the Core Rulebook, in the examples of different kinds of authentication, it says: "Mesh ID: Some systems accept mesh IDs as authentication. This is extremely common with most public systems, which merely log the mesh ID of any user that wishes access. Other systems will only allow access to specific mesh IDs, but these are vulnerable to spoofing (p. 255)." This sort of seems to imply that the other listed means of authentication (passcode, passkey, biometric scan, ego scan, and quantum key) are not vulnerable to spoofing. However, on page 255, under Circumventing Authentication, it says "Lacking a passcode, the hacker can try to subvert the authentication system in one of two other ways: spoofing or forgery." That strongly implies that you can spoof your way into a system even if it requires a passcode and you don't have it. And it sort of implies that you can spoof your way into a system that requires other kinds of authentication as well. So what is the intent? It's clear that if a system only requires a mesh ID for authentication, I can easily spoof it (just assume that the signal is not encrypted, or that I have the encryption key). What if it requires a passcode? Do I have to acquire that separately, or can that be simulated with a successful spoof? What about a physical passkey? What about a biometric or ego scan? (Side question: if a system is important enough to require authentication beyond a simple mesh ID, what are the chance of the authentication *not* being encrypted?) Finally, the Core Rulebook also says, "Rather than hacking in, an intruder can try to subvert the authentication system." I'm assuming this is meant to imply that straight-up hacking bypasses all authentication requirements -- I can always attempt to hack into any system, regardless of whether it requires passcodes or passkeys or ego scans or whatever. Is this correct? Thanks as always.