[CS-FSLUG] OT: Laugh or cry?

[Stephen J. McCracken]

We all make fun of the government like the classical definition of
oxymoron being military intelligence and then today I ran into this:

I went to a government website today and was given the opportunity to
create an account to keep track of some things more easily.  I went
through the process and came across this:

<verbatim>
Security:
You are entering an Official United States Government System, which may
be used only for authorized purposes. The Web sites for the Department
of Homeland Security (DHS) have been established in accordance with the
Interim ISS Directive, which includes regular risk assessments and
certifications. The Chief Information Officer of the Department of
Homeland Security is the final authority on security requirements and
controls for DHS Web sites. Every effort is made to ensure the quality,
integrity, and utility of the information on this site while ensuring
privacy and security. Only authorized personnel may alter Web pages.
Unauthorized use of this system may result in criminal, civil, and/or
administrative penalties.
</verbatim>

Ok, this sounds good.  Things seem to be under control!  After accepting
the agreement, I came to the next page where I would enter my
information for the account.  There I came across this:

<verbatim>
 Account Information (Note: Your User ID and Password must be between 8
and 14 characters. Your Password must contain at least one number, at
least one English uppercase character, and at least one English
lowercase character. Your Password may not have more than two
consecutive identical characters. Every 90 days your Password will expire. )
</verbatim>

Ok, I thought this is pretty annoying (having to change passwords), but
understandable after working in the IT field.  I was surprised at the
strong requirements on the password, but this is a government website
with "high security" I thought.

and then I received a confirmation message about my account creation...


...through email...


...that contained...


...my username and password in plain text!


Laugh?
or cry?

sjm