Re: Password "Hint" Feasibility

[John Earl <johnearl@xxxxxxxxxxxxxxx>]

Richard,

Richard Jackson wrote:

> Change the problem.  Whenever someone calls, don't try to help them discover
> their password, reset their password to the same as their userID and mark
> the profile as "must change password on next log-on".  Now you can skip the
> whole "hint" technology and put the problem back in the lap of the users.

In an organization with 5000+ users, how can any I.S. employee know that they 
are
actually reseting the password of the person that called, and not some imposter?
It's a very real problem.

jte



--
John Earl                    johnearl@400security.com
The PowerTech Group      --> new number --> 253-872-7788
PowerLock Network Security   www.400security.com
--




+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---