RE: Account Lockouts

["Cunningham, Andy" <acunningham () rsasecurity com>]

For resetting passwords, one technique is to leave the password
information on that user's voicemail.   Ok, there's the chance that
their voicemail could be compromised too, but it does add a level of
difficulty for the attacker.

Andy

-----Original Message-----
From: Skander Ben Mansour [mailto:securityfocus () benmansour net] 
Sent: 04 December 2004 21:26
To: 'Dean Saxe'; 'David LeBlanc'; 'Harrison Gladden';
webappsec () securityfocus com; secprog () securityfocus com
Subject: RE: Account Lockouts

Hello Dean,

In many environnements, the helpdesk could be able to call back the user
on a known telephone number.
This method also has its flaws, but is quite common in corporate
environments.
Similarly, banks should have their customers' telephone number in their
records.

Best regards,

Skander Ben Mansour, CISSP
---
http://www.benmansour.net/


-----Original Message-----
From: Dean Saxe [mailto:Dean.Saxe () DigitalInsight com] 
Sent: Thursday, December 02, 2004 4:49 PM
To: 'David LeBlanc'; Harrison Gladden; webappsec () securityfocus com;
secprog () securityfocus com
Subject: RE: Account Lockouts


Even if the user calls, how do I know you are the user in question and
not someone impersonating the user?  I don't have a great answer for
this and its a question that comes up regularly when dealing with locked
out accounts or resetting passwords.