[kobayashi]

People on HN have actually argued that "its private / a valid authentication factor"?

I'm rather surprised. To me, this seemed like a longstanding given (in this community).