> the scheme As I already stated I'm no longer certain what scheme we're actually taking about. Is there some reason you don't feel like elaborating? For my p

> the scheme As I already stated I'm no longer certain what scheme we're actually taking about. Is there some reason you don't feel like elaborating? For my part I thought we were taking about a proof of possession scheme in addition to regular auth. The "regular auth" scheme was unspecified so could be password, software based TOTP, hardware token, whatever. Widespread proof of possession already exists in the form of chips in bank cards. It seems to be quite resilient to attack in practice. Even if I use software on my phone for proof of possession you still have to compromise the computer I'm actually logging in with, no? So the attack surface is either the same (primary device) or increased (primary plus secondary, simultaneously) depending on various practical details regarding implementation and usage. If the "regular auth" scheme involves a half decent hardware token then good luck compromising that remotely. I won't be betting in your favor.