Does authentication have to be hard?