The university I attended did something similar. To graduate you had to apply online. However, they never actually integrated the graduate application process

The university I attended did something similar. To graduate you had to apply online. However, they never actually integrated the graduate application process with their auth process. So when you applied to graduate you had to "sign" your application with your password. This app, password and all, would then be emailed out to everyone in the Records and Registration office. I presume they then manually logged into my account, and if that succeed I had verified my identity. If this password wasn't tied to, say, the ability to take out a student loan then maybe it wouldn't be a big deal. I tried explaining to the person who answered the records office phone that this process was broken and I needed another way to identify myself (I'm an out of state student). They didn't care and didn't understand the issue. No one took me seriously until enough people tweeted about it that a PR person contacted me and had IT fix the problem. So: Mr(s). Non-technical also tend to have very different ideas about passwords than, for example, HN readers.