What would be a good way to authenticate a user to authenticate to websites and applications over a smart phone? By good, I mean that it is both secure, and user-friendly. Passwords don't seem to be the best fit because a password needs to be long to be secure, but it is hard to type a long password on a smart phone. Some thoughts I have begun to think about are biometric measures (e.g. possibly facial recognition), and / or a token. I asked a very similar question of authenticating a user to the smartphone itself here: What is a good way to authenticate a user to a smart phone?
Consider SQRL. It's a quite new, free, token based authentication system, using a client application. To authenticate, the client signs a cryptographic challenge with a per-domain private key. Thus it offers per-domain pseudonymity.
SQRL or Secure, Quick, Reliable Login (pronounced "squirrel") is a draft open standard for secure website login and authentication.
Some more resources: