Certificates (I'm assuming assymetric encryption) are better than passwords in that they aren't passed on to the receiving site. This means that sites can buil

Certificates (I'm assuming assymetric encryption) are better than passwords in that they aren't passed on to the receiving site. This means that sites can build databases of public keys rather than passwords, and that an attacker compromising such a site, rather than getting a password file that he can reuse all over the place, only gets a fairly useless public key which would let him identify the user. And of course there aren't any dictionary attacks for keys either. Which isn't to say that multi-factor auth isn't a good idea, it's just that certificates are still better than passwords.