Re: RE: How to authentificate an user via telephon?

From: Robert Sieber (rsieber@web.de)
Date: 12/06/02

  • Next message: CTillett@harcourt.com: "RE: Preventing DHCP from allocating IPs" 
    Date: Fri, 6 Dec 2002 07:51:05 +0100
From: Robert Sieber <rsieber@web.de>
To: security-basics@lists.securityfocus.com

    Darryl,

    the Programm PasswordStation sounds really great - if the costumer have a single sign on it would be the best solution!

    Robert

    "Darryl W. Malcolm" <DMalcolm@acuent.com> schrieb am 05.12.02 23:26:23:
    > Avatier has a product which would allow users to reset their own passwords
    >
    > -----Original Message-----
    > From: Robert Sieber [mailto:rsieber@web.de]
    > Sent: Wednesday, December 04, 2002 1:51 PM
    > To: security-basics@lists.securityfocus.com
    > Subject: AW: How to authentificate an user via telephon?
    >
    >
    > Thanks for all replies!
    >
    > For me it ist a very hard question because I don't
    > know where all of the up to 20.000 clients are
    > located - there are also RAS users with tokens
    > ode PKI chipcards. The other problem is that all
    > clients are employed by bank institutes and so
    > passwords are more critical than in other cases
    >
    > I thought about th following procedurs:
    >
    > - help desk has two telephone numbers
    > - the client will get a call back from help
    > desk
    >
    > Well, lets see.
    >
    > Robert
    >
    > > -----Ursprungliche Nachricht-----
    > > Von: bsm14096@ad.creighton.edu [mailto:bsm14096@ad.creighton.edu]
    > > Gesendet: Mittwoch, 4. Dezember 2002 18:43
    > > An: Robert Sieber; security-basics@lists.securityfocus.com
    > > Betreff: RE: How to authentificate an user via telephon?
    > >
    > >
    > > Robert,
    > >
    > > In a past life we would send the new password to a known email address
    > > for the person whose account is reset. If email is not available we
    > > would leave the reset password on the users voice mail. Both systems
    > > would only be accessible by the person whose account is reset. If
    > > someone other than the owner of the account requests a reset, the
    > > account is still safe, assuming email and vmail are secure.
    > >
    > > Bryan
    > >
    > > -----Original Message-----
    > > From: Robert Sieber [mailto:rsieber@web.de]
    > > Sent: Tuesday, December 03, 2002 12:50 PM
    > > To: security-basics@lists.securityfocus.com
    > > Subject: How to authentificate an user via telephon?
    > >
    > > Hello colleauges,
    > >
    > > imaging the following situation:
    > >
    > > User calls the helpdesk to reset/alter some kind
    > > of account-password (NT, RAS, PKI-PIN ...) and you
    > > has to determin wheter the user is the correct
    > > (owner of the account) user. What would you do
    > > to authentificate the users identity?
    > >
    > > What are good methodes to do this? It should be
    > > easy for the user but secure for the administration.
    > >
    > >
    > > Robert
    > >
    > > --
    > > http://board.protecus.de - Firewalls, Security and more ...
    > >
    > >
    > >
    > >
    > >

    ______________________________________________________________________________
    Wie ware das: mehrere E-Mail Adressen - aber nur ein Postfach ?
    Kein Problem mit WEB.DE FreeMail - http://freemail.web.de/features/?mc=021127

    Relevant Pages

    • Re: Account lockouts
      ... for reusable passwords and the AAA infrastructures that rely upon them? ... In that context, account lockout policy -- duration, threshold, lockout ... > cracking attacks. ...
      (microsoft.public.security)
    • RE: Restrict user
      ... | passwords for user accounts in Active Direcoty. ... | to go about setting up this user to only be able to reset ... Right click on the OU and choose Delegate Control. ... In the delegation of control wizard, select your generic account, then ...
      (microsoft.public.win2000.active_directory)
    • Single sign on
      ... How to authentificate an user via telephon? ... > Avatier has a product which would allow users to reset their own passwords ... >> for the person whose account is reset. ... >> would only be accessible by the person whose account is reset. ...
      (Security-Basics)
    • Re: Login 2000 Problems
      ... passwords to blank, but it says the domain "Patricia" is not available. ... > the same mistake again, and to reset the password for any ... >>> single account they have, and when it fails then they are stuck. ...
      (microsoft.public.win2000.general)
    • Odd account lockout activity
      ... Also check domain policy for expiration times on ... passwords and lockouts. ... >their account was locked out. ... >reset after 20 minutes. ...
      (microsoft.public.win2000.security)