Flutterby™! : Password Pain

<gripe>Why do so many different systems have so many different rules enforced for unique ids and strong passwords?</gripe>

I started working for Uncle Sam a couple months ago. As part of that, I've had to prove over and over that I'm an American Citizen. That's actually a little more challenging for me because I was born in Germany and the State Department's form number for my birth certificate is different from the one they use now... But that's another issue...

In my regular work, I log into about a dozen different systems. Each one has it's own standards for user IDs and passwords. Some require numbers and punctuation in the user ID, some require numbers in certain positions in the password. All require changing passwords every 90 days. So I've had to resort to the worst possible security failure: maintaining a list of all my user ids and passwords on paper that I carry around with me.

Further, I'm not allowed to have admin rights on my workstation at work. I'm supposed to be exploring extensions to OGC geospatial server protocol standards. I can't do that without installing different server packages and modifying them. And on Windows, that can't be done without admin access.

I work for the USGS. By our mission, we never work on secure information and the results of all of our work is public domain. There's no need for this level of security!

I thought I left this all at work until I tried to pull my credit reports last night from AnnualCreditReport.com provides a gateway to the big three credit agencies to request your reports. I was able to get to Experian without much trouble. TransUnion asked me for a user ID and password which I never got right. So I tried their password help but couldn't get the secret question right. I finally had to order that one over the phone.

EquiFax was the worst. I did have my user ID or password, so I used the password help. The question was "What is your first child's middle name?" My first child has two middle names so I was guaranteed to get it wrong. Ultimately, I ended up on the phone with some guy in India. His first question: "What is your Social Security Number?"! After authenticating myself to this guy - had to provide details about two accounts on my credit report like max limit and account number - he finally told me that my user ID was my first name plus the last five digits of my SSN. He then said the answer to my secret question was "Heidi" which is my first child's FIRST name!

After finally logging into EquiFax and getting my report, I figured I should change my user ID and password to something I might actually remember next year. It turns out that EquiFax requires numbers in your user ID and your last name can't be part of it. So, once again, I had to create a user ID just for this system, write it down and file it away.

The biggest irony is that it doesn't take nearly 1/10th this amount of authentication to actually open an account based on my credit. In fact, more and more places don't even require a signature when you use a credit card.