Physically secured versus low security

Physically secured versus low security

Possessing a physical device and knowing a password is a classic example of 2FA. Forms of authentication that people usually talk about are something you have (like a physical token), something you know (like a password), and something you are (i.e. a biometric). The idea with 2FA is that you require two different categories so someone who wants to compromise your security needs to overcome two different kinds of obstacle. For example, your Yubikey still counts because someone who wants to bypass your security needs to learn your password and get physical access to your key.

Indeed; but if you ignore the physical security aspect, my Yubikey protected by a password and my actual password boils down to just two passwords, and if we're saying that passwords are only for low security applications, that's just two methods only suitable for low security applications.

The thing that makes my Yubikey a useful second factor is that the physical security of my Yubikey is good enough for the applications I have for it (it lives with my keys, and I cannot go 24 hours without noticing if it's gone missing as a result); in practice, therefore, the Yubikey is a second factor because of the physical security.

Similar thoughts apply to a strong password written down on a note in my wallet - yes, that's "less secure" than the same password memorized, but it's a heck of a lot more secure than a Google employee using "Google1600 AmphitheatreParkwayMountainViewCA94043" as a "memorable" password (company name and HQ location).