For now, users will have to value security enough to deal with the inconvenience.

I think the problem is that average users reject inconvenience.  This is why something like 10 percent of phones are protected with pins like 0000, 1234, and 2580.

I think facial recognition technology might not be precise enough.  There's a margin of error even with fingerprints and retinal scans.

I remember "Doc" Smith, and no, I don't think we're going to see anything a Lens very soon.

As I understand it, DARPA envisages authentication software which can be installed on a desktop or laptop.  If it requires linking back to some external database (in the cloud or wherever), then it will have the same vulnerabilities as fingerprints, retinal scans, etc.  I think the aim is to have the device recognize its owner directly, not search a database to identify its owner.

It's going to be hard to get billions of folks to agree on what the solution might be and make it seamless.

Adapting to two steps of anything vs. one step is not easy. Adding a new gadget does't help either. It's got to be automatic or at least as easy as typing in six letters or numbers.

Usman, the problem isn't so much with other people guessing your password, as with brute force/dictionary attacks which are automated and can ultimately crack any passwords which aren't very long and complicated (too long and complicated to be remembered).

Kim - I had the same feeling that Google is off base here. The two stage authorization that we have is better. Even sufficiently secure passwords would be just as good. Discussing security and convenience in the same breath is a bit of an oxymoron. For now, users will have to value security enough to deal with the inconvenience.

I think it may be a good idea to use facial-recognition as a tool for authentication. Already almost all computers have a webcam so there won't be a need for any additional equipment. Phones like Google Nexus are using facial recognition for authentication in place of passwords so this is something that websites can also do.

@Mitch: I recently read about a research being done that authenticates you based on your pattern of typing. It makes a note of your frequency of keypress and the kind of interval you take between each key. The research said that the method was fairly accurate.

@SunitaT: The problem with biometrics (particularly the fingerprints) is that you need a special biometric scanner to be attached to the system. While the new laptops/desktops may come with it, what about the existing systems. I don't think it's worth purchasing a new device just for the sake of authentication.