People on HN have actually argued that "its private / a valid authentication factor"? I'm rather surprised. To me, this seemed like a longstanding given (in t

People on HN have actually argued that "its private / a valid authentication factor"? I'm rather surprised. To me, this seemed like a longstanding given (in this community).