Re: Self-Service Password Reset Practices

[Cal Frye <cjf () CALFRYE COM>]

We currently require either an in-person visit to our help desk or a fax of the
photoID. All the info below is too easily obtained by third parties. We would
consider only a web-form system with personalized or otherwise obscure
identifying information. Ideally, the user could create the question-response
pair for greatest security.

Email notification is a safeguard for every account but email, of course. We've
seen issues of unauthorized password changes in the past, and would not want to
make it too easy to spoof.

--Cal Frye, Network Administrator, Oberlin College
 www.ouuf.org, www.calfrye.com
GnuPG ID 43061C16, Public key http://www.calfrye.com/cfrye.asc

  "Guard against the impostures of pretended patriotism." --George Washington.


Russ Wade wrote:
> We are considering requiring the following information for password resets:
>
>         First Name
>         Last Name
>         SSN
>         Date of Birth
>         Current Mailing Zip Code