What characterises a possession-based authentication factor ("something you have"), and what are its weak points?

It relies on something only the subject physically or digitally possesses, such as a hardware or software token with a private key, an electronic passport or ID card, an authentication token, a certificate or a cryptographic key.

The idea is that the verifier challenges the object, not the person's memory. A good possession factor holds a secret that cannot be read out or copied (a key in a chip), so proving possession means proving you have that object right now.

Strengths:

• Secrets can be long and random, far beyond what anyone could memorise.
• Hardware tokens can do cryptography (challenge-response), so their output cannot be replayed.

Weak points:

• Loss and theft: an object can be lost, stolen or damaged, and whoever has it holds the factor.
• Cloning: a software token (a key file, an app secret) can be copied without the owner noticing; hardware with non-exportable keys resists this.
• Recovery cost: a lost token needs a replacement and a secure re-binding process.

That is why possession factors are usually combined with knowledge or inherence (a PIN or fingerprint to activate the token), so that stealing the object alone is not enough.

Go deeper:

• Multi-factor authentication: Possession (Wikipedia) — connected, disconnected and software tokens.