Re: Authentication of remote users

[Joel Rosenblatt <joel () COLUMBIA EDU>]

The point of the ID card is that you just do a RESET of the id if they present the card (Over the phone, by knowing the 
card number, or by fax) - the ID is not
active at that point, but put back to the initial state.  It then requires them to know the proper secrets to 
re-activate it.

We will not re-activate an ID without having the person standing in front of the help desk with their photo ID in hand 
- the best we will do if you have that
ID and can read us the number is a reset (same for fax).

Thanks,
Joel Rosenblatt

Joel Rosenblatt, Manager Network & Computer Security
Columbia Information Security Office (CISO)
Columbia University, 612 W 115th Street, NY, NY 10025 / 212 854 3033
http://www.columbia.edu/~joel


--On Friday, January 04, 2008 1:48 PM -0500 "Hunt,Keith A" <keith () UAKRON EDU> wrote:

> > -----Original Message-----
> > From: Cal Frye [mailto:cjf () CALFRYE COM]
> > Sent: Thursday, January 03, 2008 5:01 PM
> > To: SECURITY () LISTSERV EDUCAUSE EDU
> > Subject: Re: [SECURITY] Authentication of remote users
> >
> > Hunt,Keith A wrote:
> > > -----Original Message-----
> > > From: Cal Frye [mailto:cjf () CALFRYE COM]
> > > Sent: Thursday, January 03, 2008 12:46 PM
> > > To: SECURITY () LISTSERV EDUCAUSE EDU
> > > Subject: Re: [SECURITY] Authentication of remote users
> > >
> > > Gary Flynn wrote:
> > >>
> > >> Lets say you have a user that:
> > >>
> > >> 1) forgot their password
> > >> 2) forgot their answers to their secret question(s)
> > >> 3) is traveling making visiting the helpdesk impossible
> > >>
> > >> Lets also say asking for last four digits of SSN is
> > >> not allowed.
> > >>
> > >> How do you authenticate the identity of the user and
> > >> allow them to change their password?
> > >>
> > >>
> > > Here we require they fax (or sometimes an email will do) a photocopy
> > of
> > > their ID card, which does not itself contain SSN data, but our
> > internal
> > > ID number instead.
> > >
> > > I have never quite understood the thinking behind this approach,
> > > though I have seen a number of folks propose it.
> > >
> > > What if someone steals my ID card, or I lose it and someone else
> > > finds it?
> > >
> > > How does the possession of such a credential prove anything about
> > > the identity of the person who holds it?
> >
> > I might ask the same regarding the "secret questions" approach. Many
> > folks can easily determine my mother's maiden name, or my favorite
> > color, etc.
>
> Sure, and I would say that these are therefore poor choices for secret
> questions.
>
>
> > But as the number of copies of a student's ID is a low finite number
> > (in
> > most cases) holding the card itself reduces the opportunity for fraud
> > considerably.
>
> Perhaps, but if I lose my card there are a large number of people who
> might find it. And for the one who does the opportunity for fraud is
> pretty high.
>
> > As for other solutions being discussed, our help desk is mainly manned
> > by student workers, who probably ought not to have access to the kinds
> > of personal data being discussed. Asking to "see" the photo ID permits
> > them to launch the password reset process without having to call a
> > staff
> > member to the phone. I don't think it's more or less reasonable than
> > the
> > "secret question" approach our self-service system uses.
>
> I still don't quite understand this use of a photo ID (not picking only
> on you, Cal, there have been a number of messages in this thread that
> mention it). Seems to me the whole point of the "photo" part is so one
> can compare the picture to the face of the person presenting it. Without
> the face you might as well be looking at a copy of a membership card for
> the Buck Rogers Space Rangers Club.
>
> > As time goes by, more and more of our users have set up their secret
> > questions, and the self-service approach has already measurably
> reduced
> > the load on the help desk.
> >
> > --
> > Regards,
> > -- Cal Frye, Network Administrator, Oberlin College
> >
> >    www.calfrye.com,  www.pitalabs.com
> >
> > "No job is so simple that it can't be done wrong."
>
>
>
> --
> Keith Hunt  330.972.7968  keith () uakron edu
> Internet & Server Systems
> The University of Akron



Joel Rosenblatt, Manager Network & Computer Security
Columbia Information Security Office (CISO)
Columbia University, 612 W 115th Street, NY, NY 10025 / 212 854 3033
http://www.columbia.edu/~joel