Haha. I've been playing around with (and written about) the idea of a new set of authentication factor categories. I think part of the public perception proble

Haha. I've been playing around with (and written about) the idea of a new set of authentication factor categories. I think part of the public perception problem is the "things you have, know and are" slogan of authentication (factors). It is super catchy, but makes biometrics ("are") way too prominent. It promises you can prove who you are by who you "are". Why the need for the other 2 categories? I'm still on the fence as to the replacement, but I think seperating the factors based on "knowledge" versus "possession", and then further based on high versus low "transferability" is a good start. Smart cards are highly transferable possession factors, whereas biometrics are lowly transferable possession factors. Passwords are highly transferable knowledge factors, whereas things like keystroke dynamics are lowly transferable knowledge factors. The model really just lacks a catchy slogan now.