Some good questions. >>Isn't this the equivalent of giving somebody private URL, like in the article? It's essentially the same, functionally, as a password yo

Some good questions. >>Isn't this the equivalent of giving somebody private URL, like in the article? It's essentially the same, functionally, as a password you remember. Except passwords are less secure, as people use the same ones repeatedly, or generate them from a simple system repeatedly (less vulnerable to automated password guessing attempts, but as vulnerable to a dedicated human attacker). Sort of, but not exactly. Login forms, when correctly submitted, usually set a session cookie in the browser. Cookies are sent back to the server with later requests, so you could think of the cookie as if it was part of the URL. Every time you log in, though, you get a cookie with different data inside. That's different from a private URL, because the private URL would always remain the same once it has been assigned. If the private URLs are generated by a secure random number generator, then they could potentially be more secure than passwords are. Being secure and hard to guess also makes them long and difficult to remember; and that's why passwords are used far more often than random private links. Passwords are meant to be possible for a person to remember and type. Also, passwords are possible to change, so if your password is compromised, you can keep your account and just change the password. >>Are their web frameworks that let you determine if a user is genuine by their behaviour as much as their passwords? E.g. if I usually log in from the US, why am I suddenly logging in from Russia, less than a half-hour since I logged in via the US? I'm not sure if there are frameworks for that, but I know that some companies have implemented similar kinds of things. Bank of America's website that allows you to access your account data adds a few extra features that add security to the standard username/password combo.