Forgot Your Password? No, I Forgot Your Stupid Password Policy. We Need Universal Identity Management.

OK. I'm not even going to try to disguise this rant as anything but. For the umpteenth time, I go to some site that requires membership. I've got accounts on literally THOUSANDS of such sites over the years. And, there are a few things that universally piss me off when they happen. And, if you run a web service, a web site, a forum or a blog, there's a pretty good chance your implementation (and many of mine unfortunately) are in my sights.

1. Inane password security "rules" like requiring a number. Having worked on enough web apps and seeing passwords go by, I can tell you that the only difference between cracking accounts at sites like these and sites that don't require it is adding a "1" to the end of every dictionary word you use.
2. When that inane policy isn't posted ANYWHERE near the login box. If you force me to deviate from my normal password routine (the routine has a definite pattern to it, but not the same password) that means that the next time I visit your site (which isn't likely to be any sooner than 6 months based on past experience), I'm going to attempt my normal routine and fail. And have to hit the "lost password" link. And have to choose another password that doesn't fit my pattern. That isn't the same as "any of the last 10 passwords" on your system. However, if you just put the damn inane password policy right there on the login page, I'd go, "Oh, yeah, I need to deviate and use that *other* pattern to get in here" and I won't spend the next 3 days badmouthing your site and company to everyone I meet.
3. Making "my email address" my account name. Look, I understand your desire to have uniqueness constraints in your database table 'users'. I really do. However, you can still use the email address as unique, just let me choose a username. Do you have any idea how many email addresses I have? And how often they change? The first time I used your site I may have been using my corporate account, but now want to use the site in a personal capacity. But, which email address did I use? After my experience with Comcast ever changing naming and aquisition a few years ago, the idea that any email address you don't own the domain for is some sort of permanent thing is a joke. I had cable internet for 4 years and the company changed names (and forced me to a new email domain) 5, yes 5, times. I hadn't yet bought wynia.org for the first few and had to face trying to change my email address flipping everywhere.
4. Using my "home" phone number or the address *you* have on file as the way to prove who I am. I recently dealt with a company over the phone who hung up on me because I wasn't calling from my "home" phone number and didn't give my "right" address. Turns out (after speaking with "Jacob"s manager) that I would have had to break into a house I lived in 6 years ago in order to be "myself". If they'd been able to give me the city, I'd have rattled off the address with no problems.

Which leads me to a final point (and maybe a way to salvage some value besides the rant). I want a single place to authenticate. Make that one place really secure and easily revokable. Make it addressable at a single point, but portable and redirectable. Do NOT make it tied to email address. When I go to a forum, a new blog or your store for a single visit, I want to be able to just say, "This is who I am" and be done with it. If I happen to come back on a regular basis, great. But, I am just SO sick of creating new "accounts" every . . . single . . . #$%^&* . . . day.

Fortunately, there's a lot of work going on in this space and this week Phil Windley has a great series of posts from the Internet Identity Workshop that are well worth the read to see what's going on with Internet Identity.