I always find alternatives to password security interesting, but I don't think any are actually feasible at the moment. We need to realise that passwords are here to stay for a long time, and we need to promote the use of strong passwords that will last a long time.

"8 characters with a number" - the criteria many normal users consider a good password, is just not good enough any more in this ago of $2.50 an hour for an EC2 instance with a few graphics cards.