Really? Harvard asking this question???<p>It should be obvious to anyone that the device requesting authentication should never help those requesting authentication. The client (or user) should never be trusted.<p>Ever.<p>Ever.