Assurance

[Steven Carmody <>]

I'm wondering why so many sites that are interested in Silver are so 
interested in two-factor....

I haven't looked at the Silver profile in a long time. But, my memory is 
that strong passwords, stored sufficiently securely, and not replicated 
into uncontrolled environments (eg google), would pass muster with 
Silver. I'm assuming, of course, that the other Silver criteria (eg 
around identity proofing, account claiming, etc) would also be met.

I can imagine that there may be issues with those passwords passing 
through a variety of systems (eg systems that are then authenticating 
users against a central ldap, for instance). But, that's just a guess -- 
I would be interested in hearing about specific concerns that are 
driving sites toward two-factor.

Thanks for any light you can shine on this!