Re: Password hints

[Neil Matatall <neil.m () UCI EDU>]

I like websites that let you create your own question(s).  I can make up
something as specific as "what CD were you listening to on flight x".
Of course, this allows people to enter a mother's maiden name type
question so a combination of the free-form pre-populated questions is
what I think works best.

Neil

Jason C. Belford wrote:
> Ian,
>
> > Does anyone have advice for what sort of questions might be allowable
> > or wise to use for password challenge-response in the event someone
> > forgets their password? I think recent guidelines have ruled out using
> > your mother’s maiden name and other old standards.
> > How have you handled this at your campus?
>
> Currently we have a list of 72 questions and pick 9 at random to display
> to the user (when setting up the challenge-response questions).  A 10th
> option is where they can write their own question.  We have seen some
> very impressive (and imaginative questions) being asked as well as those
> like "Mother's Maiden Name."
>
> We are re-evaluating our hints, but we have learned a few lessons about
> user behavior in our attempts.  Mostly importantly, stay away from
> questions, which will have ephemeral answers (i.e. what is your
> favorite....).  
>
> --Jason
>
> --
> Jason C. Belford
> Information Security Manager
> Office of Information Technology
> Georgia Institute of Technology
> Phone: (404) 894 - 6159