Re: Challenge/response questions?

[Dave Ferguson <gmdavef () GMAIL COM>]

You might take a look at this white paper.

http://www.fishnetsecurity.com/sites/com.fishnetsecurity/downloads/Forgot_Password_Best_Practices_v2.0.pdf


On Fri, Apr 10, 2009 at 12:57 PM, Witmer, Robert <r.witmer () snhu edu> wrote:

>  There must be a better way!  We have a customized single sign on solution
> and are looking at self service password resets from a web page.  Everything
> after authentication has been worked out.  Currently we are thinking of
> using challenge/response type questions to verify account ownership.
> However, either most of the information is available on line (mother’s
> maiden name = genealogy sites) or includes personally identifying
> information (SSN last 4) that we don’t collect and don’t want to use.
>
>
>
> Anyone have a better idea?  If not, anyone have better challenge/response
> questions?
>
>
>
> Regards,
> Bob