> The difference between houses/cars and online accounts is that a physical key must be joined to the single matching physical lock, which reduces the number of

> The difference between houses/cars and online accounts is that a physical key must be joined to the single matching physical lock, which reduces the number of possible attackers dramatically and forces them to operate in meatspace. Sure but a digital physical key uses a much more difficult password than you could memorize so even though there are more attackers the difficult of breaking the key has gone up. > Physical keys to digital accounts cannot be as easy to replace because if they were, anyone anywhere might be able to persuade the digital "locksmith" that they're me, and the worst case scenario for the social engineer is that their attack fails and they try again later. I fail to see how this is different from the current password status quo. This is quite literally a well published attack vector into accounts, call up support and pretend to be the other person using their data from w/e leak happened recently enough. With a physical key there's going to be way less people forgetting their password so the same staff can spend more time verifying that somebody is who they say they are (or a company can do the same quality will less staff).