RE: How to authentificate an user via telephon?

Hi Robert

There are a lot of scenarios.

However, for the "ups, I typed wrong 3x in a row", I have seen the following solution:
A voice-recognition system, where you can call a system and through a menu and auto generated number sequence (that need to be repeated with your voice) can reset your account. Work 24/7 - if you want.

Other solution, call superusers ?

Best regards

  Bent

-----Original Message-----
From: Robert Sieber [mailto:rsieber@web.de] Sent: Tuesday, December 03, 2002 7:50 PM To: security-basics@lists.securityfocus.com Subject: How to authentificate an user via telephon?

Hello colleauges,

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

imaging the following situation:

User calls the helpdesk to reset/alter some kind of account-password (NT, RAS, PKI-PIN ...) and you has to determin wheter the user is the correct (owner of the account) user. What would you do to authentificate the users identity?

What are good methodes to do this? It should be easy for the user but secure for the administration.

Robert

-- 
http://board.protecus.de - Firewalls, Security and more ...