Using Smart-cards for authentication is a great idea. The problem of this is that you could be forced to have a unified identity across all accounts. This has p

Using Smart-cards for authentication is a great idea. The problem of this is that you could be forced to have a unified identity across all accounts. This has potential privacy and blacklisting implications. David Chaum knew this all in 1980 and proposed a great solution: Allow each user to keep a database of pseudonymous identifiers such that one is associated with each organization will be automatically presented when needing to authenticate. "Security without Identification Card Computers to make Big Brother Obsolete": http://www.chaum.com/articles/Security_Wthout_Identification.htm http://www.chaum.com/articles/Security_Wthout_Identification... Edit: It should also be noted that if you use multiple pseudoanymous identities no PKI is necessary which solves a major MITM and infrastructure problem. You simply link a public key to your paypal/gmail/whatever account upon creation. Only paypal/gmail/ needs to know about that mapping.