|
Posted by Walter Roberson on February 18, 2007, 1:26 pm
If you were Registered and logged in, you could reply and use other advanced thread options
>I might use the following approach:
>When user is created, an Email will be sent to him
>Email will contain a link to a https web page (link will only last 24
>hours)
>On the web page, he will be prompted to answer a secret question (he
>chose the question + answer when creating his account)
>If successfull, the page will display the generated password ( he will
>have to change it at his first login).
>Same procedure if he wants to reset his password.
If person X has not yet created an account but is authorized to
have one, then what safeguards exist to prevent person Y from
creating an account in person X's name?
Is all of this happening in an internal network, or over a public
network? If intended as an internal network, recall that email has
a tendancy to get read outside of the internal network, by forwarding
or VPNs or proxies or "webmail" pages. If intended as an internal
network, what degree of trust is there of the users?
Is there a list of authorized users? If not, then how will you prevent
joke accounts or multiple accounts per user?
>The only problem I can see is Phishing using a web page that would
>look like my web page.
Worries about phishing tend to suggest to me that you are planning
to do this over public networks.
| ![[development] password generation/sending](/images/header.jpg)
XML site map