Tapas: design, implementation, and usability evaluation of a password manager

This paper introduces Tapas, a concrete implementation of dual-possession authentication leveraging a desktop computer and a smartphone that requires no server-side changes to websites, no master password, and protects all the stored passwords in the event either the primary or secondary device is stolen.