Assurance

[Tom Scavo <>]

In section 4.2.4.3 ("Credential Renewal or Re-issuance") of the Silver IAP, 
it suggests "A short-lived single use Secret sent to the Address of Record 
that the Subject must submit in order to establish a new Authentication 
Secret," which could be interpreted as using email to deliver a short-lived 
secret for the purposes of password reset. However, email-based password 
reset is vulnerable to a lost or stolen mobile phone (since mobile phones 
invariably have access to all the user's e-mail accounts) so I'm wondering 
how people plan to handle password reset for Silver compliance?

I wonder if this topic will come up on tomorrow's EDUCAUSE Live! presentation 
(http://net.educause.edu/live) where the topic is "Bring Your Own Device" 
(BYOD)?

Thanks,
Tom