I use a combination of cookies, fingerprinting, and web-of-trust verification (by volunteer moderators). The WoT works by building a DAG of "vouch" tags for eac

I use a combination of cookies, fingerprinting, and web-of-trust verification (by volunteer moderators). The WoT works by building a DAG of "vouch" tags for each user. For more capable browser, client-side signing using a private key is available. There is always an accessibility-security gradient, and there are trade-offs you have to make on every side. The needs of each user are different, and many would prefer to trade a lot of security for a lot of accessibility. For example, if someone un-housed is only using borrowed devices, older tech, library computers, public wifi, many would happily trade some security for being able to let their loved ones know they're OK. They're not worried about espionage or privacy, they just want to be able to send an "I'm OK" message to their family every day or two. For this type of scenario, and many others like it, a simple http-accessible website behind a simple password is by far the best solution I've found to date.