The real solution here is a delegated authentication protocol like OpenID, BrowserID/Persona, OAuth, or Facebook Connect. Asking users to maintain 100+ strong p

The real solution here is a delegated authentication protocol like OpenID, BrowserID/Persona, OAuth, or Facebook Connect. Asking users to maintain 100+ strong passwords is ridiculous. Password agents like 1Password or LastPass work OK for now, but those agents become high value targets themselves and the core design is not very secure. Delegated authentication designed from the beginning to be secure is the solution. And we've had technical implementations of that going back at least 10 years (Microsoft Password, client-side SSL, OpenID). The reason they haven't succeeded is a combination of product design and political problems. Mozilla's BrowserID / Persona project is looking promising. Tim Bray at Google has also been talking about identity a lot lately, maybe Google will offer a solution too.