I am looking for an authoritative source to back up my position in a disagreement over password policy.
I am having a disagreement with a client about the user identification/authentication process for a system. The nub of it is that they want each user to have a globally unique password (i.e. no two users can have the same password). I have wheeled out all the obvious arguments against this (it's a security vulnerability, it confuses identification with authentication, it's pointless, etc.) but they are insisting that there is nothing wrong with this approach.
I have done various google searches looking for authoritative (or semi-authoritative , or even just independent) opinions on this, but can't find any (mainly it's just such an obvious faux pas that it doesn't seem worth warning against, as far as I can tell). Can anybody point me towards any such independent opinion, please?
I've found a Daily WTF article, but (apart from being too humorous to be authoritative), it suffers from the problem I've mentioned above - the inadvisability of this approach is so self-evident that it doesn't seem worth explaining why.
To clarify, I understand the problems and can even explain them to the client, but the client is reluctant to accept them, hence my request for independent and/or authoritative sources.
Any pointers to independent and/or authoritative sources confirming that this is A Bad Idea gratefully received...