What people aren't really mentioning on this thread is what sort of burden a non-password system adds to the average site developer
What's the answer? Have all sites use OAuth and delegate to sites like FB / Twitter and hope they get more secure?
I've seen sites like http://www.loginprompt.com that try to provide authentication as a service, but they're all still fairly rudimentary or expensive.
I hate OAuth and all related technologies with a passion. My personal strategy is that any targeted site can be crack and my password is probably stored there in a reversible format (if not straight plain text). So I don't expect to secure any given account, only isolate it from all others. That means I use as secure a password as the site allows (some sites don't let you use symbols!) and always totally different. I use a password manager to keep track of these passwords for me so even I don't actually know what they are after I've made them.
But my whole strategy is defeated behind my back because of this idiotic OAuth/whatever technology. Now only one of my accounts needs to be hacked on a high profile site and suddenly every site that gives an OAuth option is compromised for me, even though I've never used OAuth one time.
What's the answer? Have all sites use OAuth and delegate to sites like FB / Twitter and hope they get more secure?
I've seen sites like http://www.loginprompt.com that try to provide authentication as a service, but they're all still fairly rudimentary or expensive.