I've been tasked to work on a password reset tool for my company website. This tool is for a support person to provide a new reset password over the phone in case the customer does not receive the email or is locked out of their email account.
Now firstly I would personally say this isn't ideal as I believe there are other methods such as receiving a reset code via phone - however as that's apparently not an option I was left with the task.
So I was tasked to add 2 security questions to the users' accounts, where the questions are pre-selected (by the user) out of about 14 questions. The idea being that a user will call and be asked the questions and if both answers were correct then the password would be reset and given to the end user.
While building the reset form I went ahead and decided for extra security to add a post code (UK company and customers) and their primary contact number - both which are required on sign up. The process then being: take users email, confirm post code and primary phone number, ask for security question answers - if all ok then give new password.
The disagreement I had was with the other members of my team who thought this amendment was completely unnecessary. Personally I thought this would be an additional step from a data protection point of view and an added level of security.
My question is who is right? Am I being too protective or are the other members of the team being too hasty?