While password protection was designed to make conducting online transactions safe for consumers, it has resulted in what some industry experts are calling 'password bloat.' It has been estimated that an average Web user has about 30 password-protected accounts, and requests to reset forgotten passwords represent 50 percent of all help-desk calls to websites, according to RSA Security. The search for alternatives to the multi-password annoyance has resulted in few options. Some websites use a layered approach that uses other identity-type information. For example, by the end of 2006, all federal banking agencies will require online banks to ask for two types of identification to access an account. Small companies like Siber Systems offer secure 'vaults' in which passwords can be remembered and managed, but consumers remain worried about giving control over their digital identity to third parties. A popular feature of the Quicken financial software from Intuit is the 'PIN vault,' which keeps a user's various passwords so the software can get financial information from other sites. Microsoft Corp. would like to eliminate passwords altogether, and its new Vista operation system will allow consumers to create 'information cards' that act as encrypted digital identifiers. This approach requires both consumers and vendors to buy into the system, however, and previous attempts at similar systems failed. The use of tokens has become popular. Tokens are small devices that generate a random six-digit password every 60 seconds. Software is also available to analyze users typing habits in order to build biometric profiles that are used as identification for banking websites.