Ultimately, however...
I do not see the need for a government regulated password system. If that warrants calling me short-sighted, so be it. But look at it this way - we have a government which is already deep, deep in the hole with respect to finances, and they're... creating a new institution? No matter how minor, this is just stupid in that regard...
Especially seeing as (a.) it does not satisfy any immediate needs, only a precieved one, (b.) is untested and will require further expenditure on an already over-streched system to operate, and (c.) inevitably will be abused by third parties, and more than likely the government itself. There are certainly counterpoints to this, but ultimately is there anyone here who seriously puts so much faith in the government to approve of this?
I do recall signing a petition against this... Unfortunately, it might take more than things like that to stop something like this from going through.
the government really has no buisness developing this kind of technology. they would put more effort into the bureaucracy to manage it than into the technology development itself. id rather it be done by a private company, like google. and while the government might spy on you, so too could the company. really theres no way to get around that. but it is a problem in need of a better solution.
i do however recognize a problem that exists not in the individual management of user accounts, but in the accumulation of multiple independent (or centralized) accounts online for everything from government and banking sites to cheezburger network. i merely state that its impossible for the human mind to remember 10s or even hundreds of unique user names and passwords. especially when you enforce password complexity and regular updating of passwords. when the human memory fails, we use software or even the writing down of passwords. you might limit the amount of information you need to keep. like only use one user name on all sites, or only remember a pool 10 secure passwords and rotate them as needed. the mere referencing accounts to other accounts (such as using an email address as a login name) adds to the problem.
if the user has a set address pool and you know the password to say their battlenet account so you go to their email and try the same password and it might work, then you can try to go into their bank account and the password might not work, but since you have access to their email, you could probibly go through and mine personal information from accounts youve gained access too and do a password recovery at their bank and clean out their account. these are all the security holes i can see.
websites want too much information
too many unique sequences to remember
too much linking of accounts
automated password recovery
dependance on email addresses
dependance on 3rd party systems
large number of sites requiring logon data
now you can probibly get around those with password management software, but thats a locally configured system with no defined protocols to talk to a web site requesting logon information. what i say is make it easier for that system to communicate with local password management software. so when you go to a website than needs your login data, it will send a request to your computer for that information, then a service on your computer provides those credentials, and you are logged in automatically. the service automatically assures password complexity and can quickly respond to requests for password updates. you only define the communication protocols, not their usage. this ensures that you may use whatever software you want to use, and the web host only uses what software they want to use. and this allows the 2 pieces of code to communicate despite possibly coming from different sources. point is you eliminate human nature as a source of the problem.
