Hacker News new | ask | show | jobs
by lxgr 1873 days ago
> something in addition to a credit card number

Two things, actually. The credit card number doesn't count as a "thing" anymore.

This is why SMS-OTP alone is not sufficient (representing only possession), but mobile phone app based solutions are (they represent possession of a linked device and usually ask for biometrics or a PIN code).