Even if both the email and phone conversation are recorded, it is orders of magnitude easier to search an email database for "password" than it is to search voice recordings.

However, best practices say that one, and only one person should know the password for an account, and that is the person who owns the account. The admin should not know it, nor should the server (i.e. hashed password).

The usual way to do this would be: if the password has recently (for a given value of recently) expired, the user can use their old password, but immediately on being authenticated (before logging in), they are forced to change their password, then immediately disconnected. If the password has expired some time ago, the administrator can mark the expired password as "recently expired" for a short period of time - (e.g. 10 minutes). The administrator does not need to know what this password is. If the user has forgotten their password, the administrator can issue a short time (e.g 10 minute) password which also forces immediate change of password.

An admin should not know a user's password, if it can be avoided. If needed, they should have the ability to become another user with their OWN password, which is then written to an audit log. This is especially important if there are several levels of "administrator" (i.e. if there are people who can change passwords, but not affect the audit log).

Minor obfuscations (such as security by audio, image etc), are dangerous, because they foster complacency without security.

Even if both the email and phone conversation are recorded, it is orders of magnitude easier to search an email database for "password" than it is to search voice recordings.

However, best practices say that one, and only one person should know the password for an account, and that is the person who owns the account. The admin should not know it, nor should the server (i.e. hashed password).

The usual way to do this would be: if the password has recently (for a given value of recently) expired, the user can use their old password, but immediately on being authenticated (before logging in), they are forced to change their password, then immediately disconnected. If the password has expired some time ago, the administrator can mark the expired password as "recently expired" for a short period of time - (e.g. 10 minutes). The administrator does not need to know what this password is. If the user has forgotten their password, the administrator can issue a short time (e.g 10 minute) password which also forces immediate change of password.

Also, if a user has changed their own password in the last year, they should be exempt from the change (until exactly 1 year after their last change).

The theory that a password should be changed once per year is also exceedingly dubious, in most cases - if a password is compromised, it is usually maximally exploited immediately. Only giving an attacker "only" 6 months of access (on average) seems fairly pointless (or "only" 6 days for that matter). This suggests 2-factor authentication, with the second factor being unique each time (Google Authenticator, OTP, OPIE, challenge-response etc), if the resource is worth protecting.

An admin should not know a user's password, if it can be avoided. If needed, they should have the ability to become another user with their OWN password, which is then written to an audit log. This is especially important if there are several levels of "administrator" (i.e. if there are people who can change passwords, but not affect the audit log).

Minor obfuscations (such as security by audio, image etc), are dangerous, because they foster complacency without security.

Even if both the email and phone conversation are recorded, it is orders of magnitude easier to search an email database for "password" than it is to search voice recordings.

Even if both the email and phone conversation are recorded, it is orders of magnitude easier to search an email database for "password" than it is to search voice recordings.

However, best practices say that one, and only one person should know the password for an account, and that is the person who owns the account. The admin should not know it, nor should the server (i.e. hashed password).

The usual way to do this would be: if the password has recently (for a given value of recently) expired, the user can use their old password, but immediately on being authenticated (before logging in), they are forced to change their password, then immediately disconnected. If the password has expired some time ago, the administrator can mark the expired password as "recently expired" for a short period of time - (e.g. 10 minutes). The administrator does not need to know what this password is. If the user has forgotten their password, the administrator can issue a short time (e.g 10 minute) password which also forces immediate change of password.

An admin should not know a user's password, if it can be avoided. If needed, they should have the ability to become another user with their OWN password, which is then written to an audit log. This is especially important if there are several levels of "administrator" (i.e. if there are people who can change passwords, but not affect the audit log).

Minor obfuscations (such as security by audio, image etc), are dangerous, because they foster complacency without security.