> A password in the "things that you know" sense of Two Factor must be memorable for it to meet that definition. Nonsense - it's even in TFA: > The best passw

> A password in the "things that you know" sense of Two Factor must be memorable for it to meet that definition. Nonsense - it's even in TFA: > The best passwords are truly random strings that are unmemorable "Something you know" isn't necessarily "something you memorised" - I 'know' my credit card number by virtue of having the card but I can't rattle it off on command without looking it up. A password simply has to be information only you have access to - something you know - as opposed to a physical device that generates a token - something you have.