The problem with passwords be that they be often easy t' steal or guess, 'n that either ye need t' re-use simple passwords across multiple sites in order t' be able t' remember them all or use a password manager t' store them, in which case spyware needs only copy the encrypted data file 'n keylog the master password in order t' steal all a them.

I propose a solution in which a user would have a small USB device that contains an inaccessible storage microchip containing a unique identifier 'n private encryption key for each login, as well as a public section with the required software/drivers. When the user wants t' log into a website or application, the server then uses the respective public key stored for that logon t' encrypt a random string as an authentication challenge. The client then sends the challenge string 'n a master password t' the USB device, which then decrypts 'n returns the challenge string based on the respective private key. This response be returned t' the server, thus authenticating the user 'n triggering the server t' commence the user's session.

If spyware best steal the master key t' the tool it be useless as the private keys be permanently stored on the USB device 'n be never visible t' either the client or the server. If someone be t' steal the USB device it would be impossible t' use as they would not know the master key ('n even if they be t' disassemble the device t' pillage at the closed storage it would be a simple matter t' encrypt it based on the master password). The odds a someone simultaneously stealing both the digital 'n physical elements a the system be very slim, thus greatly increasing security while reducing the number a passwords a user needs t' remember t' one.

Thoughts? (Assuming anybody has a clue what I be talking about :P)