Password substitute desperately sought

In a more ordinary example, Google recently began nudging users to consider a two-step log-in system, combining a password with a code sent to their phones.

Google’s latest Android software can unlock a phone when it recognizes the owner’s face or — not so safe — when it is tricked by someone holding up a photograph of the owner’s face.

As mobile phones become bodily appendages for people worldwide, they too are emerging as instruments to verify identity. Google introduced its two-step process before this year. It sends a six-digit code to an application on a Google user’s cellphone to be entered, along with a password, when signing onto a Google account on a computer or tablet. The code can as well be sent as a text message for those who don’t have smartphones, or it can be conveyed through a phone call.

The extra step is not mandatory

The extra step is not mandatory, and the company will not say how widely it has been adopted. Nevertheless as vulnerable as passwords are to theft and compromise, Google says, it is increasingly important for a user’s identity to be verified through another channel — a cell phone, in such a case.