Authentication should always start with "something you have," never with "something you know." A username field asking for human-readable data before anything else is, by itself, a sign the system is vulnerable, no matter how strong the password policy or how many factors come after it.

It's always important to use the right tool for the right task. A surgeon's finest knife is useless for cutting down trees, and a lumberjack's best axe would be disastrous in surgery. That's not a hard concept, yet nearly every time we identify ourselves online with a username and password, we're forced to use the wrong tool for the job. Some might call that a minor risk. The data says otherwise: failing to adapt how we authenticate has real, recurring consequences.

A Case in Point: The Binance Hack

Today's headline is yet another example: hackers stole over $40 million worth of bitcoin from one of the world's largest cryptocurrency exchanges. This isn't new, or even surprising. By now it's almost predictable.

In its official statement, Binance said hackers made off with roughly 7,000 bitcoin, worth about $40.6 million at the time, using a variety of attack methods to carry out what the company called a "large scale security breach" on May 7, 2019. The hackers also obtained user API keys and two-factor authentication codes, the same codes required to log in to a Binance account.

Why Breaches Rarely Have a Single Cause

Serious accidents are rarely the result of one failure. Like in aviation, disasters are usually caused by a chain of multiple events: errors, omissions, and mishaps. Preventing further accidents means addressing all of those causes. Unlike aviation, though, the online world isn't tightly regulated, which lets most companies keep making the same mistakes over and over.

The Root Cause: Starting the Login With "Something You Know"

Let's address one cause that applies to more than four out of five security breaches, one that's easy to fix but still a massive hole in most systems: traditional login with a username and password, followed by traditional "two-factor authentication." Verizon's Data Breach Investigations Report has repeatedly found that stolen or weak credentials are involved in roughly 81% of hacking-related breaches, so the Binance pattern isn't an outlier, it's the norm.

How do you spot this problem? It's easy, no need to dig deep. If a login screen shows an input field labeled "username," that's it. You're in trouble. It's the hole in the wall that invites in thieves.

To be specific: anything containing human-readable data ("something you know," in authentication terms) should never be used as the identification or primary verification factor. Never.

"Something you know" is fine as a secondary, tertiary, or higher-order factor, alongside biometrics, geolocation, time fencing, and similar signals. But if you actually want protection from people trying to steal your money, influence your elections, crash your stock, or expose your private information, don't let the system accept "something you know" until it has already verified you with "something you have." Not the other way around.

"Something You Have" Isn't a New Idea

Starting authentication with possession isn't novel, most of us already use solutions built this way. An ATM never starts by asking for a username and password, you insert your debit card first. Airport security doesn't start by asking your name, TSA wants to see your ID card and boarding pass before anything else.

Underused Solutions That Already Exist

There are excellent, innovative solutions that go underused precisely because consumers rarely demand them from the businesses and governments they interact with.

Smartcard IDs, for instance, are far more resistant to counterfeiting than traditional ID cards, and they let cardholders authenticate securely online using certificates generated and stored in secure elements. Properly designed mobile authenticator apps take a similar approach, built on right-factor authentication instead of the broken foundation of usernames and passwords, starting the process with something you have. Smartcards and mobile apps can even complement each other, giving flexibility depending on the use case and login context.

When properly integrated with a correctly implemented PKI infrastructure or secure distributed data storage, these mechanisms can prevent exactly the kind of loss Binance experienced, where attackers "managed to get their hands on user information such as two-factor authentication codes." It's a straightforward way to save money, time, and headaches.

FAQ

Why shouldn't a username and password be the first thing a login screen asks for?
Because both are "something you know," human-readable data that can be phished, guessed, or stolen, as happened in the Binance breach. Starting with "something you have" instead means there's no password or username to steal in the first place, even if an attacker gets everything that follows.

Did two-factor authentication fail to protect Binance?
The attackers obtained the 2FA codes themselves, alongside API keys, through phishing and other techniques. Traditional 2FA built on top of a username and password doesn't remove the password as an attack surface, it just adds a second thing to steal.

What's an everyday example of "something you have" coming first?
An ATM: you insert your debit card before entering a PIN, not the other way around. Airport security works the same way, your ID and boarding pass come before anything you'd need to say.

What's the practical alternative to usernames and passwords?
Smartcard IDs and mobile authenticator apps built on right-factor authentication, which starts the login process with a possession factor (a card, a device, a token) instead of a typed credential, with "something you know" or biometrics layered in afterward if needed.

The Bottom Line

With today's technology, using the right tool for the job is easier than ever. Identifying yourself online with "something you have" is the most obvious, convenient, and secure approach available. Stick with usernames, passwords, and traditional two-factor authentication instead, and you might as well take an axe to your own computer, at least then, nobody else could use your data against you either.