Passwords (or passphrases) are really the only way to securely verify the "something only you know" factor of authentication. Alternatives either devolve to sto

Passwords (or passphrases) are really the only way to securely verify the "something only you know" factor of authentication. Alternatives either devolve to storing a password somewhere else (password safes, passwordless, etc) or to "something only you have" (tokens, smart cards, biometrics). It's easily arguable that the "something only you have" factor should be the primary factor, especially for low security systems, with "something only you know" being the secondary factor for high-security systems, but the economics have tended to reverse the situation. It's a lot cheaper to ask a user to memorize a password than to get smart cards or fingerprint scanners for everyone.