The three factors for authentication are, again:
- something you have
- something you know
- something you are
You can of course not use any of these for authentication without additional constraints. To use any of these for authentication it is important that an adversary cannot replicate the authentication factor.
Generally names can be easily guessed, which means that a user name is not suitable to use as a factor for authentication.
Similarly, having a smart card is of little use if an adversary can simply extract any secret information that is stored on the card.
Biometrics are not very useful if the authentication can be fooled by accepting a picture or gummi fingerprint.