Re: [cpx] Wishlist: forgotten password

[Scott Wiersdorf <scott@xxxxxxxxxxxx>]

On Fri, Apr 22, 2005 at 03:14:56PM -0500, Rae French wrote:
> At this point, there isn't anyway for the user to access their account 
> without our intervention if they forgot their password.

That's correct. The domain admin can intervene, if you have that kind
of a hierarchy.

> Then how about a script-generated one that would overwrite the existing 
> one? 

I still don't see how the end user could receive the new password
securely. I can't be mailed to their CPX account (since they need the
password to login). I'm open to any other ideas you might have on
this. You can do the "what is the name of your pet?" style of
authentication, but that's essentially another (much, much, weaker)
form of authentication and has to be stored also somewhere on the
server.

Scott
-- 
Scott Wiersdorf
<scott@xxxxxxxxxxxx>
======================================================================
This is <cpx@xxxxxxxxxxxxx>      <http://www.groupmail.org/lists/cpx/>
Before posting a question, please search the archives (see above URL).