Quoting from CompTIA Security+ guide
The first factor of authentication (something you know, such as password or PIN) is the weakest factor.
Why? it makes sense when we say that humans/users are the weakest factor in any system from security point of view as we humans forget, make mistakes and break easily. But it makes no sense (to me a least) that getting kidnapped and tortured (in order to give up my password) is more likely to happen than me losing a smart card or a key fob?
In the typical case, something you are and something you have can only be true for one person at a time. If you lose your token, you know you have lost it.
Something you know can be copied by someone without your knowledge. If someone has your password, you may not be able to tell that they are actively exploiting that knowledge.
That is one reason to change your password regularly. It shortens the window where a password breach could be exploited.
Passwords, or more generally something you know, are often relatively weak, because users cannot remember high-entropy secrets. As a result, passwords (or anything you need to memorize) usually ends up being a low-entropy secret, which enables random guessing, offline dictionary search, and other attacks. While it's possible to create and remember a pretty good password, experience shows that users don't -- and that it is probably unreasonable to expect users to do so.
There is a tremendous amount of academic research and practical experience that backs up this statement. Here are some example references:
The science of guessing: analyzing an anonymized corpus of 70 million passwords, Joseph Bonneau. 2012 IEEE Symposium on Security and Privacy. [Analyzes data from tens of millions of user passwords. Shows that making 10 guesses at an account password will compromise about 1% chance of compromising the password, and that about half of all passwords have entropy 20 bits or less. In other words, many/most passwords are weak.]
Are there any academic articles on how people handle their passwords?
See the entire passwords tag on this site.
In addition, any secret you know can potentially be phished (i.e., someone might be able to social-engineer you into revealing it).
Remember the classic statement:
Humans are incapable of securely storing high-quality cryptographic keys, and they have unacceptably slow speed and accuracy when performing cryptographic operations. (They are also large, expensive to maintain, difficult to manage, and they pollute the environment. It is astonishing that these devices continue to be manufactured and deployed. But they are sufficiently pervasive that we must design our protocols around their limitations.)
Charlie Kaufman, Radia Perlman, Mike Speciner, Network Security: Private Communication in a Public World.
At this point you might be wondering: Given the passwords have so many issues, why do we still use them? If so, I recommend you take a look at this question: Why do we even use passwords / passphrases next to biometrics?.
It is possible to have a "something you know" which you cannot be forced to disclose. I read about a secure login system which presents a grid of 12 to 15 photos of faces, and you have about 3 seconds to touch the 3 or 4 that you have seen before. For this to work, there must be a database of many thousands of photos, and you train on hundreds of them. The system knows which ones you have trained on. (you give a user name first which is assumed to be "public" - not secure.)
You cannot possibly convey this info to another person, and any success in one login conveys zero success in another. For "something you know" to be effective, we should simply use aspects of human nature that work effectively. Most people can recognize previously seen face photos - it is built in.
This is the result of the excellent marketing done by biometric authentication vendors.
"Something you are" is sometime very easy for an attacker to reproduce, fingerprints and voice are especially easy to obtain, without the possibility for people to use credible strategies to avoid it (wearing gloves at all times and not speaking in public is not practical).
Most of us likely leave dozens of exploitable fingerprints everyday, I for one don't say my password out loud nearly that often.
"Something you have" is not without faults either, and requires a great deal of user education to be used properly. E.g. in any RSA SecureID company, a tour of the office will reveal many of them on desks, the code being visible. I even saw people carrying them around their neck with them. Also the disappearance of an authentication token may not be noticed until it is needed.
The biggest (and only) problem of password based authentication is that its strength is set by the user, and there is a strength-usability tradeoff. In theory, passwords have lots of great properties for an user: they are hard to obtain from third parties by force, you don't leak them everywhere like biometric data, they can be stored as hashes unlike biometric data, users can stay anonymous to the service (if you share your mobile phone number for 2 factor or give them your fingerprints you lose that), users can tell the password other people, and share access. Try that with biometrics, or key fobs. So passwords offer more control to the user, which can be an advantage, but most times is a disadvantage.
Then there are problems in implementation. First you need to set a completely distinct password for every place you have to use a password. This is because most times the other party gets your password in plaintext. When you use a strong authentication scheme like SCRAM-SHA1, you never transmit the password to any third party, and can use a scheme like "strong password" + "website name" for your password. This usage of passwords however is very unclear to separate. You can create a small device where users enter their passwords into, which guarantees that the password never leaves it, but the user can be spoofed by the computer and think they have to enter it there. There it is again, the strength relies on the user.
