I do wonder when/if companies will move wholesale to avoiding security mechanisms that rely on the secrecy of particular pieces of static information (e.g. pass

I do wonder when/if companies will move wholesale to avoiding security mechanisms that rely on the secrecy of particular pieces of static information (e.g. passport numbers, Social Security Numbers (In the US)) etc. The number of breaches of personal data now mean that in many/most cases an assumption that only a person knows something about them is extremely unlikely to hold across a large userbase. Of course you then fall back to "how do you validate that someone is who they say they are" and probably things like biometrics, and/or other forms of 2FA will need to feature.