The third party login is excellent function that has come in recent years that relieves the load on a programmers mind so that I have to remember less useless passwords.
I don’t use the same password for many sites, I use an algorithm: for instance if I make a password for StackOverflow its name starts with S so I’ll put in an S and then with my secret sentence so the password for SO will be something like i81b4uS, e.g. my secret phrase plus some token that makes the password not the same for every since since I don’t want the disaster if some site saves my password in plaintext and gets hacked (then somebody would have access to all my online material if I used the same password).
Biological metrics are good but this technology is not here. In the future we will probably only have to unlock at one point all our online material, instead of providing the system so many locks. Google’s 2-step verification is flexible and goo but it’s not perfect.
Are there other, perhaps newer, or less known, authentication methods for instance that simplifies the common use-cases of renewing a password (where it is often tedious to check your mail where you often get interrupted, and providing the old password to change it to a new etc) and reset password, which is a lot like renew a password?
I’m not asking for the detail of which algorithm, but rather if there are newer and more effective flows, like third party login which made me start an account at SO where I landed with me Google account, that puts less of a burden on the user’s mind and manual memory and that are also safe?
At my site I offer authentication much like SO and SE, where you can login at my site just like SO with Google, FB, Linkedin, Yahoo or custom accounts. I’ve used webapp2’s user model to facilitate my logins and the simpleauth library for GAE (python).
What would especially be good would be getting rid of email altogether and not bugging users about their email address at all. Some users are hesitant to leave their email, and email is often too much of a direct contact. So many users have smart-phones and androids so that there could be one app for many sites that does the authentication via smart-phone or a desktop app or a large third-party like Google, FB or Yahoo where I can offer Google, FB, Yahoo, LinkedIn so that a user can have a choice not to make up a new password, since that can be painful if you already have memorized 40 passwords for different sites and services.
3
Mozilla Persona, that seem to be really great. I didn’t have the opportunity to test it yet, but I saw some demos and it sure looks cool.
The coolest part is that it’s decentralized.
“At Mozilla, we believe that your online identity should belong exclusively to you. With that in mind, we created Persona to improve the way you sign in to websites.
Persona allows you to sign in to sites using an email address you choose. So, instead of having to manage multiple usernames and passwords across your favorite sites and devices, you’ll have more time to do the important stuff. We’ll manage the details!”
http://www.mozilla.org/en-US/persona/
Sorry per my poor english.
Have you considered a Password Manager (e.g. – KeePass, 1Password, etc.)?
There are many available, and they have been around for a while, well-developed, and analyzed.
They are based on some very sophisticated algorithms and incorporate various encryption techniques.
For example, I use KeePass, which is free and can be run off a USB drive.
It uses a pass phrase to log in, instead of a single word, if desired.
The database can be saved elsewhere for added security if desired.
When you would like to generate a new password for a specific site, the software offers that feature; you tell it how many characters and what kind (i.e. – upper case letters, lower case letters, numbers, special characters, etc.). It then creates the password and saves it. To enter it in the site log in field, right-click on the entry and you have 12 seconds to enter it in the password field before the Clipboard is automatically cleared.
Of course, if you ever forget your pass phrase, you are out of luck. But I find it a real convenient way of organizing all my passwords and generating some real long ugly ones for good security.
1