What are some good ways to verify user identity for password resets?

Question

I'm wondering how others verify the identity of users they're resetting passwords for. We currently try to speak to a manager at work, but it frustrates end users and seems like we don't trust them. I've heard some say that sending the password via SMS has worked for them, and it seems like there's a reasonable level of security there, but only if users' cell phone numbers are already on file.

Answer 1

Essentially handling this revolves around having some combination of factors that can be used to assure that the user requesting the reset is the same person who has authority to the account.

As you've noted in your question one of the problems tends to come where retrofitting a password reset system to an existing application as the required information may well not have been gathered initially.

Methods I've seen include

• e-mail address. I primarily see this on websites where the user has registered with that address and therefore it's used as the reset location. If you have that and no other information it may be a tenable solution.
• SMS messages. Mobile phones tend to be unique to a given person in most cases, so reset to phone (either by voice call or SMS) could be a decent option.
• Online reset with management approval. Heavy to setup but I've seen systems where if a password reset request was made e-mails were sent to "approved" persons (eg, manager) and those persons then confirmed the request (handy in big companies to reduce helpdesk costs)
• A Bad option (from a security standpoint) that I've seen is confirmation of some personal information that the company may have about the staff member (eg, staff ID, managers name, dept name etc) This might be reasonable with regard to complete outsiders, but there's a big risk of internal users already knowing thise

Ultimately the checking with managers option is also common and hopefully users could understand that it's not IT staff not trusting them, but that IT staff have to make sure that someone else doesn't access their accounts without authorisation..

Answer 2

some other methods:

• the "secret question" / "secret answer" pair on sites
• asking specific questions about the use of the account (ex.: how many stock trades you made yesterday? this week?)
• the need to phone call to request the reseting of the password. Ex.: "hi company BlahBlah, I tried to access my account, by it says it's locked and that I should phone you. Yes, I can provide some informations. Yes, I can say a specific phrase so you can record and compare my voice."
• the need to inform some data from some token (like OTP). Ex.: to use a site you just use your password, but to "unlock" it you have to type some data that's in token that generates a one-time password, or that's in a paper-card that they sent you, etc. In the daily use, you just need a password, don't need to carry the token with you all the time.

Answer 3

I have also seen where the help desk will ask for another authorized user instead of just a manager. They utilized secret questions (over the phone which is silly, but hey) of an authorized user and then that user verifies that they know the user who is getting the password reset. Works great for a large company that is spread thinly all across the globe, or for consultants who travel.