It is safe to assume that the majority of users accessing the internet also possess the mobile phones. So can we take advantage of this and relieve users of remembering any passwords.

Instead of registering users on the website, the site can register their mobile phones. The mobile phone number is being used by gmail as the optional second-factor authentication.

Could any such schemes be designed and implemented in which user always login using one time passwords and do not have to remember any passwords for any of the websites? If the mobile phone is lost, then all accounts are compromised. To counter that the mobile phone will have 1 master password or a biometric password. Apart from saving users the burden of complying with the different password policy of every site, such schemes will also prevent offline attacks as there are no passwords stored on the server.

Can such cost-effective schemes or protocols be designed so that users do not have to remember any passwords at all?

  • Wlcome to Information Security. Please note that your question will get answers that are primarily based on opinions. – Uwe Plonus Sep 17 '14 at 5:41

Using the mobile phone as single authentication factor would be very bad.

The mobile phone number is being used by gmail as the optional second-factor authentication

The import part here is "second-factor". It sound like you are proposing to use the mobile as a single authentication factor. That would be very bad because mobile phone are not secure. If your device get compromised the attacker would also get access to your webpage.

Like on normal computer there are many ways to attack a phone. Think about remote exploit or an evil app. If you lose your phone it even worse. If you did not fully encrypt the device your lock screen would not protect you. Even with encryption the attacker could brute force the password.

Anyway using the mobile phone as second-factor is a good idea but it can not replace a password.

By the way: biometric passwords are bad because mostly you can copy them very easy and you have big trouble changing them.

Update in response to the comment: Password manager vs one time password via mobile phone

Mobile phones and password managers are very different. One is a mostly bad protected device that is very likely to be lost, while the other is an encrypted file on a device.

You could intercept the one time password while it's send to the device (SMS is not encrypted). HTTPS might be broken. Phone numbers can be highjacked and routed to other devices. You would need to authenticate your phone to the website.

Assume you have done that and you fully encrypted your phones with a strong password. Now it's like a password manager? Nope. Phones are mostly turned on even if lost, so you can recover the encryption key from RAM.

  • @Pi but if server gets compromised all user accounts are at risk. I am not proposing anything here, just gave an example. – Curious Sep 17 '14 at 8:06
  • 1
    @Curious I was only talking about the phone. If you use your phone as authentication your account is compromised if you lose your phone. – PiTheNumber Sep 17 '14 at 8:45
  • @Pi how is this different from the password manager, by the same reasoning, password managers protected using master passwords are also not secure. The scheme of mobile phone is similar to password manager. To compromise the accounts, only password manager has to be compromised, but in case of mobile phone scheme, the device has to be stolen and master password has to be compromised. – Curious Sep 18 '14 at 6:38
  • @Curious I updated my answer because that did not fit in here. ;) – PiTheNumber Sep 18 '14 at 7:47
  • 1
    You are replacing something you know with something you have. Even though something you have is generally more secure than what you know, cell phones are notorious for being lost/stolen and shouldn't be used as a single factor. Combining a what you have (phone) with a what you know (password) will make for stronger security. I wouldn't use a single factor that is a cell phone personally though. Storing passwords on the phone might negate the advantage but that isn't something you should assume everyone does. – David Houde Sep 18 '14 at 11:55

Devices like Yubi Key have been trying to accomplish this. The underlying problem is that it is a single factor, and if lost, exposes a major risk to the user.

Matching with biometrics is also a promising field, but the technology isn't ready yet. Anything you measure for biometrics can change over time because a body changes over time. There was a prototype bracelet that measured your heartbeat patterns and adjusted its metrics to the subtle changes to your heart over time. It was promising, but still a prototype.

Killing the password has been a goal for a very, very long time. We need to keep the discussion going.

  • Can we have server identify us with our activity within the website or something of this kind, may be using our behaviour or it might identify us by asking questions about the previous session – Curious Sep 17 '14 at 15:07
  • There have been attempts to use keystroke analysis in the same way as biometrics, but it too is very early, and easy to fake and change. Imagine what a bandage on a finger would do to one's ability to type normally. – schroeder Sep 17 '14 at 15:10
  • the scheme can be designed wherein to authenticate user, he is asked question about previous sessions, that activity is known only to him as it was he who carried out them. If he answers correctly he is allwed to login – Curious Sep 17 '14 at 15:13
  • assuming that one's memory is good enough to pull random behavior from the previous session. This might work for some people for some websites, but can't be considered a universal solution. If you don't log in for a few months, will you remember? – schroeder Sep 17 '14 at 15:20
  • true, may be the same question is asked for some duration and it get changed after certain period. I agree it is not universal solution. But it creates a kind of paradox to guess password which in this particular scheme is the answer to the question, you have to login inside the account and look. – Curious Sep 17 '14 at 15:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.