Re: Password "Hint" Feasibility

[John Earl <johnearl@xxxxxxxxxxxxxxx>]

Chris,

Chris Bipes wrote:

> We have a reset program that is given to managers that sets the password to
> a default and expired.  It adopts authority and uses our internal
> application security.  Let there bosses reset their passwords.  No longer an
> IS issue and managers frown on their employees.

This is the best solution of all.  In an organization of any size, how is the
help desk going to know who they are talking to?  A hint database may help, but
it becomes a new potential point of exposure.  It makes more sense to put the
User Profile control into the hands of the local supervisors and managers.  Let
them create, delete, disable and reset profiles.  The employees are their
responsibility, and they are in the best position to determine who should be
active and who should not.  This solution also eliminates the sticky problem of
having to notify someone in I.S. prior to an employee termination... that's not
really our function, and it can put us in a sticky spot (TVOE).

jte.

--
John Earl                    johnearl@400security.com
The PowerTech Group      --> new number --> 253-872-7788
PowerLock Network Security   www.400security.com
--




+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---