Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In an answer to this question about pw reset, D.W. says:

Lastly, consider non-password authentication. Passwords have many problems as an authentication mechanism, and you might consider other methods of authenticating users, such as storing a secure persistent cookie on their machine with an unguessable secret to authenticate them. This way, there is no password to forget and no way for the user to be phished, though you do need to provide a way for a user to authorize access from a new machine or a new browser (possibly via email to the user's pre-registered email address).

How does one do that? How safe and user friendly is this solution? What are the key drawbacks?

share|improve this question
    
there is also one new in this list innovation of google and motorola. It is Motorola password Pill, I really loved their idea and egrly waiting for it. I find some details on it here motorolapill.com –  user36443 Dec 29 '13 at 12:17

4 Answers 4

up vote 7 down vote accepted

In almost any case where you click on "remember me", this is already happening on your computer. A random string of characters is stored in a cookie and linked to your account. The reason why more than this is required has to do with mobility. If you change computers, how do you log back in without the standard username / password? Users simply don't take their cookies with them.

In the case of the email suggestion, you could send a random code that can be entered into a form field, or even clicked as a link. For some marginal level of increased security, I would expire those click links after a time and store a different random code as the cookie.

share|improve this answer

There are three ways to authenticate an identity: based on what he has (phone, a device), or what he knows (a password, a story), or, what he is (his fingerprint, palm scan). The last is unusable in a remote context.

Therefore, your question is about using an alternative to what you know. That is to say, to use what you have (usually time-limited). This typically involves tokens, or one time password.

Check out some of these: http://www.duosecurity.com/, http://code.google.com/p/google-authenticator/, and http://www.wikidsystems.com/.

They are as safe as having a phone (and losing it). It is quite friendly.

share|improve this answer
    
Are you saying that a token is akin to something you know? –  Nam Nguyen May 21 '11 at 3:56

You might find this academic paper of interest: Conditioned-safe Ceremonies and a User Study of an Application to Web Authentication . The paper describes one way to use secure persistent cookies for authentication and to enable people to register a new machine using an email link. It's by no means the only way -- it is just one example, and there are probably many other possible ways of doing something along these lines.

share|improve this answer

I have met a good enough and simple authentication process of this service. It uses number of your mobile to send one time password via SMS.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.