RSA Labss (Now EMC), MIT, and ACM are wrong? 
VQuaker.  I am used to accepting correction when it is due, but for the life of me I cannot understand why cited information from a primary source (RSA Labs) on the fourth factor of authentication is not worth knowing.  I am confronted with the information that because it is not a legal requirement as far as you know, it must be spurious.  Some people know that it's better to get their legal information from government sources, not Wikipedia.  If you are holding up this resource as some type of CFR or USC guide, exposition, or sanctioned resource, then I believe the U.S. Government would like to hear your ideas.  Further, "someone you know" (or knows you) is part of network administrationwhich is part of the brilliance.  Needing a cohort or supervisor to provide a human factor is difficult to defeat.  Though, I suspect you know this already.  I'm not offended though, just immensely confused as to why this item of access control must be devoid of technical information and meet some arbitrary legal standard.  I would ask you this: if a user loses their SmartCard (i.e. CAC) and forgets their password, with the premise being that biometric devices or other inherence factor methodologies are not deployed, in most situations does an administrator with knowledge of the user ask they be terminated, or do they reissue credentials based on knowing the person?  There are organizations that will terminate you, but I couldn't have said that in my expounding of the 4th factor because it would mean citing information not available to the lay. (I do hope I can "talk" without citing what those in DF and IS would consider common knowledge.)  When we set out, it was to provide reliable information, if the mission has changed, well who could tell?  Consider me a non-contributor from now onwe aren't allowed to use Wikipedia anyway where I work, it is an anathema.  Say what you want unless it surprises someone and then an ego check is issued. I should expect nothing less, after all, I teach.  What changed the tone was your dumbing-down and use of nonsensical examples that could not be used to authenticate someone.  Smell?  Non-sequitur.  You gave me things to read, but I'm still waiting for you to cite Wikipedia's policy that information be legally sanctioned and in the format expected by a barrister.  I cited my sourcewhere is the citation that the language style, organization, and applicability be in-line with one or more regulatory bodies?

Now a better way to be proactive would be to realize that academic databases (do you have access to them [Elsevier, JSTOR, EDAS, IEEE, SpringerLink], they can be pricey if you try and yet without them you're stuck in a Google funk, but I digress) are full of references to fourth factor.  That cash register key the manager uses when you return something, yep, someone you know.  An that's been around for decades!  Sign up for an account with an ISP, there it is again!  Take joy in knowing you have some sheriff star and are for the most part helpful.  I just didn't realize you alone set these standards.  I repent in ashes and wrend my sackcloth accordingly.