> Known passwords of any type are all in the first category, Not really. People don't "know" their totp secret or their RSA secret key. But yes, when these ke

> Known passwords of any type are all in the first category, Not really. People don't "know" their totp secret or their RSA secret key. But yes, when these key-style secrets can be transfered - they behave more like "know of" than "in possession of". The simple mitigation is probably fido2 auth tokens.