These sites/articles that try to solve authentication by getting rid of passwords seem to keep forgetting something -- you still need a password/authentication

These sites/articles that try to solve authentication by getting rid of passwords seem to keep forgetting something -- you still need a password/authentication to something else. If I sign on w/ Facebook/Google, they still have to authenticate me with a password. If I have a token emailed to me, I still have to access my email with a password. If I have a token sent to me via text, I may still have to unlock my phone with a password -- and I have to have the phone on me. There are only three ways, that I can think of, to authenticate someone: 1) a password (or some other secret) 2) a token stored as a cookie or some other file on your computer/device 3) a token sent to/stored on a personal device. Most products already implement #1 and #2. They will look for a token, and if not present, will prompt for a password. In the case of third-party authentication (Facebook/Google/email), this authentication is still done via a token, and if not present, will prompt for password -- it's basically pass-through authentication. I don't think anything can be done to revolutionize either of these. That really only leaves us with #3. Texting a token to a phone works and prevents having to remember a password (or use an unsafe password), but it's still inconvenient. Has someone tried creating another device that serves as a "key" and connects to your device via USB/bluetooth that can be used for authentication purposes? This is about the only thing I can think of that would be a step in the right direction, but even then, there are probably still a handful of reasons why that would be problematic.