Re: AS400 Automatic Sending of New Password?

[rob@xxxxxxxxx]

I'm not so sure that it is so flawed.  Like accounting has it's Generally 
Accepted Accounting Practices or GAAP I think people are quite used to the 
emailing of passwords.  In fact, it's more secure to email it to a known 
email account associated with a user id than to just display on the sign 
on screen.  "You bonehead, here's a new password since you obviously can't 
remember your old one: xxxxxx".

Where in SOX do you see this forbidden?  I get tired of that bogeyman 
being waved in everyone's face.

But if you want to try the challenge question route or other techniques 
then SSO and EIM are the way to go and then research a product like Tivoli 
Identity Manager.  That will automatically handle the challenge question 
and stuff.

Rob Berendt