🚀 go-pugleaf

A similar system (user self-registers, using student ID number as a
temporary authenticator) is in use here; and we got it from MIT Project
Athena.  Yes, an intruder knowning someone's name and student ID
number can open an account (if the real person hasn't done so already).
In our situation we don't consider this a big deal because we can't
keep students from sharing login names and passwords anyway.

If this isn't secure enough for you a solution I guess would be for the
master data base to send over not the student ID number but some unique
random-ish number or string of its own making; and then to send the same
number by paper mail to the person to use in registration.  Or if you
really want to have photo ID cards checked then have the person who does
the checking give out the made-up number.

A lot of things would be more secure if we didn't use the social security
number for anything except social security.
-- 
haynes@cats.ucsc.edu
haynes@cats.bitnet

"Any clod can have the facts, but having opinions is an Art."
        Charles McCabe, San Francisco Chronicle