Comment by userbinator

I find this common "wisdom" or "best practice" questionable. Something to think about:

If I use a password, a suitably designed client can have absolutely no trace of my credential after it has been used.

If I use a key/certificate, that credential must be stored somewhere on the client, and even in encrypted form, it exists in persistent storage.