I started to ask this question to get input before discovering the one. In light of a Magistrate Judge's recommended judgement on PATCO v. People's United (which implies a horrible theory regarding multifactor authentication), I define something you have as this:
What you have must only be compromised by an attacker having physical access to what you have. This excludes:
- A password written on a piece of paper (once somebody sees it, they know it)
- A cookie stored on your computer
- "Security questions" (They are just another password)
- Your PGP key kept on a thumb drive if you plug it into a machine that has network access
That said, I would consider a paper list of 100 passwords that have no relation and are each used only once would be considered something you have. A paper list of 100 passwords that might be asked for more than once would not qualify as an attacker would be able to pretend to have access to that credential by monitoring.
Something you have must be something whose integrity can be secured by physical control. Attacks on the other side of the channel such as stealing their authentication database or breaking a cryptographic protocol don't count. If it can be compromised without an attacker's physical interference (or breaking an encryption algorithm as they are integral to demonstrating possession remotely), it is not something you have. ATM cards are a bit fuzzy that way -- a compromised ATM could provide all the track data, though what we usually see are skimmers (physical access). RSA tokens are another that I would consider something you have.
I like smartcards best because placing them in a reader won't expose their secrets, nor would compromise of the authentication database.