What would be a good way to authenticate a user to authenticate to websites and applications over a smart phone? By good, I mean that it is both secure, and user-friendly. Passwords don't seem to be the best fit because a password needs to be long to be secure, but it is hard to type a long password on a smart phone. Some thoughts I have begun to think about are biometric measures (e.g. possibly facial recognition), and / or a token. I asked a very similar question of authenticating a user to the smartphone itself here: What is a good way to authenticate a user to a smart phone?

  • 1
    Same answer from me, SSO. I'm not an SSO salesperson, I promise!
    – AlexH
    Feb 12, 2015 at 14:40
  • What are you authenticating? I mean what is the ID you are using? In many mobile apps, by using their phone number as the ID, it is easy to authenticate their ID.
    – Aron
    Feb 12, 2015 at 16:08
  • @Aron I would consider authenticating by any ID that would be easy and secure. A phone number sounds like a great idea!
    – Jonathan
    Feb 18, 2015 at 21:15

3 Answers 3


Consider SQRL. It's a quite new, free, token based authentication system, using a client application. To authenticate, the client signs a cryptographic challenge with a per-domain private key. Thus it offers per-domain pseudonymity.

From Wikipedia:

SQRL or Secure, Quick, Reliable Login (pronounced "squirrel") is a draft open standard for secure website login and authentication.

Some more resources:


Consider FIDO as a standard that's being backed by a lot of large organizations, and has already seen deployments.


Authenticate using SMS is pretty typical in mobile apps.

  • Costly and not NSA-proof.
    – user42178
    Feb 19, 2015 at 17:39
  • 1
    @AndréDaniel cheap and convenient do not make for a system that is NSA proof.
    – Aron
    Feb 19, 2015 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.