Re: Challenge/response questions?

[Bob Bayn <bob.bayn () USU EDU>]

Gary Flynn commented on some of my remarks, concluding with:


> > We've just recently given our ServiceDesk staff the ability to 
> > access a user's challenge responses so they can do confirmations 
> > over the phone and accept approximate matches to the answers.

> Isn't that kind of like giving them access to the account passwords?

What's the risk there compared to giving them the capability to reset a password when the user provides some other 
"proof" of ID?  Either can be misused and would be grounds for disciplinary action, dismissal and/or legal action.



Bob Bayn     (435)797-2396     Security Team coordinator
"IT will NEVER ask for your password via email, honest!"
Office of Information Technology at Utah State University