Good article but I think you sidestepped one of the hard parts which is to evolve the economic model such that it is to the benefit of a company to use anything other than authentication (with associated data harvesting and selling of the data). Until such time that the costs of data harvesting outweighs the benefits, we are stuck with current system. Now people choosing to not use companies that data harvest is a cost to the company but unfortunately the easier way for a company to get around that is to bury everything in a long list of terms and conditions.