back

by jader201·12y ago·view on hn ↗
These sites/articles that try to solve authentication by getting rid of passwords seem to keep forgetting something -- you still need a password/authentication to something else.

If I sign on w/ Facebook/Google, they still have to authenticate me with a password.

If I have a token emailed to me, I still have to access my email with a password.

If I have a token sent to me via text, I may still have to unlock my phone with a password -- and I have to have the phone on me.

There are only three ways, that I can think of, to authenticate someone:

1) a password (or some other secret)

2) a token stored as a cookie or some other file on your computer/device

3) a token sent to/stored on a personal device.

Most products already implement #1 and #2. They will look for a token, and if not present, will prompt for a password. In the case of third-party authentication (Facebook/Google/email), this authentication is still done via a token, and if not present, will prompt for password -- it's basically pass-through authentication. I don't think anything can be done to revolutionize either of these.

That really only leaves us with #3. Texting a token to a phone works and prevents having to remember a password (or use an unsafe password), but it's still inconvenient.

Has someone tried creating another device that serves as a "key" and connects to your device via USB/bluetooth that can be used for authentication purposes?

This is about the only thing I can think of that would be a step in the right direction, but even then, there are probably still a handful of reasons why that would be problematic.

1 comments
"Has someone tried creating another device that serves as a "key" and connects to your device via USB/bluetooth that can be used for authentication purposes?"

As far as I know many banks outside the US issue a key fob which generates tokens. Those are essentially equivalent to something like the Google Authenticator app.

Right, but even key fobs are no better than sending a token to your phone.

If this was to really get adopted -- by both the issuer and the user -- it would have to be easy. A bluetooth device would be ideal, as it would allow wireless communication to the target device being authenticated. Stick it on your keychain and forget about it.