@sun they can also be used either as an additional factor or as a replacement for password authentication