Assurance

[Eric Goodman <>]

 

> The above process is exactly what UChicago has submitted to our auditors

> for InCommon Silver.  Though we offer delivery of the secret over SMS

> in addition to email.

 

Thanks, and yes for purposes of this question, I’d think email, SMS and snail mail are roughly equivalent.

 

We also discussed whether calling a pre-registered phone number directly and talking to the individual would count, and similarly if the incoming caller ID number matching a pre-registered number would suffice (i.e., if I call from my registered number and say “give me a temporary password”, could the help desk just do so based on having validated your registered phone number?)

 

--- Eric