My favorite color is "three"

I actually ran into this yesterday. It seems like almost every password reset program has about the same questions. That there should be more mention of the way words are written. So for example explicitly mention that caps are ignored, or explicitly mention that it's case sensitive. Mention that special chars like hyphens, underscores and such aren't allowed

What about providing multiple choice? When the user has selected favorite color, just add 19 others and make them pick. This of course needs to be in line with the lockout policies. 

One method of authentication I particularly like is the use of the mobile phone to sent an authentication message to. I know that this in more in the area of access security but I really like it. You can also combine it with a password-question approach.

I'm curious, is Citrix planning on offering any kind of SMS (as in Short Message Service) integration in Password Manager?

Michel Roth
Thincomputing.net

Yes I love multiple choice tests!  Even if you don't know the answers you have a fighting chance.  But that's the problem: with multiple choice there are a finite number of clear choices, giving a hacker a fighting chance.

A note suggesting avoiding special characters is a very good idea.  I'll chat with the engineers and pubs on what we could do for our app.

On the mobile phone authentication, I spoke with Positive Networks and learned about their product, Phone Factor recently.  The mobile phone is the one device you pretty much always have nearby.  Makes perfect sense, and spares you from having an additional device like a security token (to lose or break.)  Citrix isn't in the strong authentication business, but it's still interesting.

I had an another response on the Citrix Blog where creating your own questions was suggested.  That way you could set up questions that would be extremely difficult to guess - they could be things only you know.  Nice suggestion from Donovan.

I'm intrigued by the notion of integrating SMS with CPM.  I'm not aware of it being mentioned before.  Are you envisioning linking SMS to the CPM agent and using it to see who else is logged on and to allow users to chat?  Or other purposes?

Kate Brew

CPM product manager