Requiring some form of authentication is better than requiring none. However, Portals and Rails suggests that “some” generally means a user name and password and perhaps a set of knowledge-based challenge questions. Is it time for more?