The problem with passwords is that they are often easy to steal or guess, and that either you need to re-use simple passwords across multiple sites in order to be able to remember them all or use a password manager to store them, in which case spyware needs only copy the encrypted data file and keylog the master password in order to steal all of them.

I propose a solution in which a user would have a small USB device that contains an inaccessible storage microchip containing a unique identifier and private encryption key for each login, as well as a public section with the required software/drivers. When the user wants to log into a website or application, the server then uses the respective public key stored for that logon to encrypt a random string as an authentication challenge. The client then sends the challenge string and a master password to the USB device, which then decrypts and returns the challenge string based on the respective private key. This response is returned to the server, thus authenticating the user and triggering the server to commence the user's session.

If spyware should steal the master key to the tool it is useless as the private keys are permanently stored on the USB device and are never visible to either the client or the server. If someone were to steal the USB device it would be impossible to use as they would not know the master key (and even if they were to disassemble the device to get at the closed storage it would be a simple matter to encrypt it based on the master password). The odds of someone simultaneously stealing both the digital and physical elements of the system are very slim, thus greatly increasing security while reducing the number of passwords a user needs to remember to one.

Thoughts? (Assuming anybody has a clue what I'm talking about :P)