Credential-free identification and authentication
A method of authenticating a user so that the user can access a website without entering a unique user credential. A user accesses a target and is presented with an authentication code and an address, and the user sends a message containing the authentication code to that address. Alternatively, the user is pre-supplied with an address and is presented only with an authentication code when the user accesses the target. The user's identity is authenticated by comparing an aspect of the metadata of the message with known metadata aspects, and the user is authenticated by comparing the authentication key presented to the user with the one received in the message. Both the user and the user's identity are authenticated in a single step without requiring the user to input any unique user credential.
1. A method of utilizing a user-operated device to authenticate a user with respect to a target service, comprising:
presenting, to a target user interface, an authentication passkey and an authentication address without first requiring the user to provide a unique user credential;
receiving, from the user-operated device, a message addressed to the authentication address, and comprising a test passkey and a device identifier;
detecting a similarity between the test passkey and the authentication passkey;
identifying the user-operated device as an authorized device by comparing the device identifier against a stored set of identifiers;
retrieving user credentials comprising at least a user identifier and a password by querying a user database using solely the device identifier; and
submitting the retrieved user credentials to target user interface for accessing the target service.
2. The method of claim 1 , further comprising generating, upon receipt of a request, the authentication passkey without first requiring the user to provide a unique user credential.
3. The method of claim 2 , wherein generating the authentication passkey comprises generating a authentication passkey that is unique to the target user interface.
4. The method of claim 2 , wherein the request comprises a username associated with the user.
5. The method of claim 1 , wherein the authentication passkey is user agnostic.
6. The method of claim 1 , further comprising associating the target service with the user based on the device identifier.
7. The method of claim 1 , further comprising associating the target service with different users based on different device identifiers.
8. The method of claim 1 , wherein the target user interface comprises an ATM machine.
9. The method of claim 8 , wherein authorizing the target user interface to access the target service comprises initiating a transaction with a bank account associated with the user.
10. The method of claim 1 , wherein the target service comprises at least one of a web service, a phone network, an appliance, and entry to an enclosed space.
11. The method of claim 1 , wherein the user-operated device comprises a cell phone.
12. The method of claim 1 , wherein the authenticating address comprises at least one of a URL, an SMS short code, and a phone number.
13. The method of claim 1 , wherein the authenticating address is rotated, and selected from a pool of available addresses.
14. The method of claim 1 , wherein the device identifier comprises at least one of a phone number, a MAC address, and a UDID number.