Abstract Web authentication systems use username and password mechanisms as the primary control for authorizing access to sensitive data and other resources of the Internet. While most Internet users view authentication systems as secure and usable, much research shows and many security experts believe that this view and the current authentication systems promote bad habits that result in loss of security, which poses real dangers to the Internet. Because site-centric authentication models result...