Re: Password "Hint" Feasibility

["L. S. Russell" <leslier@xxxxxxxxxx>]

I would suggest that you look at some web sites which offer password
hints. 

Most sites make sure that the user verifies their ID before sending the
password.  Some force the user to reply to an email which is sent to the
email address they used to sign-up initially.  But it should be easier
to secure an Intranet application of this sort because, if your network
is behind a firwall and uses private side addressing, outsiders
shouldn't even see your Intranet.  

Then you only need to worry about disgruntled employees, and you are
back to square one because that is always a concern.

John Hall wrote:
> 
> mkrouse@co.ottawa.mi.us wrote:
> >
> > Call me paranoid, but it seems to me that you would be making it a lot
> > easier for some unscrupulous insider (or even hacker) to get someone else's
> > password.
> >
> > Is your Help Desk really that busy that they can't handle the volume?  I
> > know ours isn't.
> >
> 
> Now why do you say that ?? :)
> 
> Just because there will be people who make the hint the same as the
> password ???
> 
> Password : BOB
> 
> Hint :  My Password is BOB
> 
> hmm -  I think you must be paranoid !!!
> 
> John Hall
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator: david@midrange.com
> +---
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---