What's your credential to claim that system is over complicated? Are you a security professional? Have you performed a full blown security audit of the system? Have you designed an alternate system which is less complicated and equally secure?