Knock knock, who's there?

Authentication is the art of determining who someone is, and to do so with certainty. Since the advent of the web, this process has become treacherous as the implications of mishandling this process can compromise the rest of the environment. This risk, despite the potential impact, is often lost on non-security personnel--the user's convenience once again causing relaxation in security. OWASP lists it as the number 2 most pressing threat in web security, and characterizes the threat as having a severe impact, as seen in the following screenshot:

OWASP Summary for broken authentication and session management

Does authentication have to be hard?

Most authentication approaches start with...