[naturalpb]

Alternate title: guide to changing your single factor authentication from "something you know" to "something you have."

[nly]

I think you mean from "something you can forget" to "something you can lose"

[ozim]

I don't remember like 98% or 99% of my passwords. I have something like 270 on my private accounts and probably 300 passwords on my work accounts. Well password manager is useful and I can always use pw reset option built in systems.

I kindly propose everyone to forget all their passwords.

Then they mostly don't need second factor if they generate random password each time and don't care about remembering them at all.

[dheera]

This is why "something you have" should be ALWAYS replaced by "one of a few things you have" where you report/deactivate any lost things.

[jasonpeacock]

"Something you have" is generally an improvement over "something you know" for most people's account security.

You have to remember where we are starting from - most people are still using the same password across all their accounts.

[1_player]

How is that? Everybody living in my house can get my Yubikey yet doesn't know my password. If I get robbed, my bank account is still (relatively) safe.

[naturalpb]

Most people won't purchase and use a Yubikey either though. Really just depends on your threat model, if remote attacks or local attacks are of higher risk. An obvious improvement would be the use of both a password and physical security token.

[dwaite]

Current Yubikeys support multi-factor, both knowledge and possession. It is just up to websites to request this.

They have a key coming (some day) which will also support a biometric factor.