The ultimate model that will emerge is going to be one that is a layered authentication approach. You will have risk-based authentication and forms of passive authentication, but, for certain segments of users and certain types of transactions that may be high-risk or high-value, there will be a need for strong credentials like one-time-password tokens.