So that leaves us with passwords

Passwords are well known but little understood
Users accumulate user-name/password pairs
- which they can't remember
- so they use the same ones in lots of different places
Administrators have to create, issue, re-issue and revoke accounts

Note that using the same password for more than one thing is a really bad idea, though we all do it
The admin hassle of passwords is significant

Passwords are well known but little understood