  Every user authentication scheme involves three login credentials, i.e. a
username, a password and a hash value, but only one of them is associated with
a user identity. However, this single identity is not robust enough to protect
the whole system and the login entries (i.e., the username and password forms)
have not been effectively authenticated. Therefore, a multi-factor
authentication service is utilized to help guarantee the account security by
transmitting a second factor to the user to use. If more identities can be
employed for the two login forms to associate with all login credentials, and
if the corresponding identifiers are not transmitted via the network and
operated by users, such a system can be more robust even without relying on a
third-party service. To this end, a triple-identity authentication scheme is
designed within a dual-password login-authentication system, which defines
identities for the username and the login password, respectively. Therefore, in
addition to the traditional server verification, the system can verify the
identifiers at the username and password forms in succession. In the
triple-identity authentication, the identifiers are entirely managed by the
system without involvement of users or any third-party service, and they are
concealed, incommunicable, inaccessible and independent of personal
information. Thus, they are useless in online attacks.
