Challenge-Response System -
Proving Your Identity Over the Phone

Purpose

The Challenge-Response Verification system (CRV) is designed to allow users to prove their identity over the phone to the Help Desk or to electronic systems when they have forgotten their NetID password. Users of CRV choose questions to which only they would know the answer. Unlike asking for Social Security numbers, CRV allows users to securely prove their identities without the associated confidentiality concerns.

Procedure

In order to use the CRV, users establish questions (Challenges) and answers (Responses) with the Online@Duke system. http://www.duke.edu/online/crv

• Users must choose or create at least three questions, but can choose more.
• These questions may last indefinitely, but users are encouraged to change them once they have been used.
• When trying to change your password over the phone, you will be asked three of your questions and must answer all of them correctly.
• For security purposes, when anyone views your questions, you will receive an email notifying you that someone accessed your questions.
• When someone attempts to answer your questions, a second email will be sent to you stating which questions were asked and which were answered correctly.

March 16, 2005