> I don't know what this means. You responded to this after your second quotation, I effectively said the same thing twice in different ways to make my point.

> I don't know what this means. You responded to this after your second quotation, I effectively said the same thing twice in different ways to make my point. Hopefully you understand it now. To be fair, it's a somewhat complicated sentence, took me a while to put that thought into words. > so you can give access to the password manager as a "something they know" anyway. Mostly true. Ignoring password manager breaches, as that hurts your argument a little. Security researchers are currently of the opinion that the last LastPass security breach leaked people's encrypted password vaults, which people have somehow managed to decrypt since then. In that case, the password was something the attacker had, not something they had to know. But I think I mostly agree that access to the password manager can at least (mostly) be seen as something they know.