I wasn't thinking about second factory actually (unfortunately I can't easily express my ideas in English, I haven't made it clear enough). The barcode would ma

I wasn't thinking about second factory actually (unfortunately I can't easily express my ideas in English, I haven't made it clear enough). The barcode would make a first (and only) factor. Of course username/password would stay there for backwards compatibility. Once again, I'll try to express myself more clearly: - we show a username/password input boxes and 2d barcode (QR/datamatrix); - the user may simply enter his username/password and then everything works your way; - he may also choose to use some kind of password manager that is compatible with this protocol; - in this case we encode some data in the barcode (it could be some login URL, e.g. https://example.com/srp/yourservice.com/?nonce=some_random_number_here https://example.com/srp/yourservice.com/?nonce=some_random_n...); - this password manager scans the code and performs full SRP authentication on the above URL; if it's successful we simply send some kind of notification to your service - or you poll our service for the result; - we check the result on the actual login page as well (e.g. using AJAX): we may simply poll some other URL, like: https://example.com/srp/yourservice.com/result/?nonce=the_same_nonce_used_above https://example.com/srp/yourservice.com/result/?nonce=the_sa... (of cource results signing/etc. comes into play here); - if the result is OK we simply set session data in the cookie as usual and from now on the user is authenticated; This has additional advantage of the actual crypto going on in the password manager and on the server. It also gives the possibility to perform the sign-up process semi-automatically as well (think of password generation - the user doesn't have to know it at all). And then think of public wifi or other networks you don't trust: you may perform the auth via GSM using your mobile. But the biggest improvement, in my opinion, is the usability aspect. You could have your password manager lying in the background and when you are shown a login page you could simply double-click an icon in your tray area and you are immediately logged into the app. Or you could use password manager on your mobile phone to take a shot with its camera. I hope this time it's clearer.