19

In an answer to this question about pw reset, D.W. says:

Lastly, consider non-password authentication. Passwords have many problems as an authentication mechanism, and you might consider other methods of authenticating users, such as storing a secure persistent cookie on their machine with an unguessable secret to authenticate them. This way, there is no password to forget and no way for the user to be phished, though you do need to provide a way for a user to authorize access from a new machine or a new browser (possibly via email to the user's pre-registered email address).

How does one do that? How safe and user friendly is this solution? What are the key drawbacks?

  • there is also one new in this list innovation of google and motorola. It is Motorola password Pill, I really loved their idea and egrly waiting for it. I find some details on it here motorolapill.com – user36443 Dec 29 '13 at 12:17
8

In almost any case where you click on "remember me", this is already happening on your computer. A random string of characters is stored in a cookie and linked to your account. The reason why more than this is required has to do with mobility. If you change computers, how do you log back in without the standard username / password? Users simply don't take their cookies with them.

In the case of the email suggestion, you could send a random code that can be entered into a form field, or even clicked as a link. For some marginal level of increased security, I would expire those click links after a time and store a different random code as the cookie.

6

You might find this academic paper of interest: Conditioned-safe Ceremonies and a User Study of an Application to Web Authentication . The paper describes one way to use secure persistent cookies for authentication and to enable people to register a new machine using an email link. It's by no means the only way -- it is just one example, and there are probably many other possible ways of doing something along these lines.

6

There are three ways to authenticate an identity: based on what he has (phone, a device), or what he knows (a password, a story), or, what he is (his fingerprint, palm scan). The last is unusable in a remote context.

Therefore, your question is about using an alternative to what you know. That is to say, to use what you have (usually time-limited). This typically involves tokens, or one time password.

Check out some of these: http://www.duosecurity.com/, http://code.google.com/p/google-authenticator/, and http://www.wikidsystems.com/.

They are as safe as having a phone (and losing it). It is quite friendly.

  • Are you saying that a token is akin to something you know? – Nam Nguyen May 21 '11 at 3:56
0

I have met a good enough and simple authentication process of this service. It uses number of your mobile to send one time password via SMS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.