FastLane PIN security Richard Moore 17 Feb 2000 09:44 EST
After reading almost all of the recent debate on fastlane PINs/ passwords and trying to digest it all I thought I'd finally wade in. I also maintain a list of PI - PINs The ones I assign are based on a "secret formula" which anyone could probably figure out if they thought about it. We are a small institution - only 38 fastlane users, including four persons w/ admin. privileges. In the last two years I have had one PI request that I change their PIN to something else (really secret) and five who called me up to say that they either forgot or never knew what their PIN was. I expect that even larger institutions would find much the same ratios between PIs who are very concerned over security and those who aren't bothered. My first reaction was like many of yours - this will never work - but after a few days I am beginning to see its not as bad as first assumed. Our NT based LAN network system requires that we change passwords every 45 days, but if we also have rights to the UNIX server those passwords expire every 30 (actually 33) days. Rather than trying to keep track of two dates I just change both at the same time - at 30/31-day intervals. (and no they are not the same, close, but not identical). So I imagine many PIs would elect to change their Fastlane passwords more frequently than the 180 days even if they aren't actively working on a proposal at that time. When I hear about a fastlane proposal being developed I do ask that all PIs assign a proposal PIN and suggest that they use our internal routing number. In fact I tell them if they want any help they have to do this. So far no one has objected - and only one person had trouble, requiring me to logon as the PI. One question that occurs to me - I haven't yet encountered proposals on which the new "allow SRO editing right" has been invoked. How if this different from editing a proposal by accessing it using a proposal PIN number? I know with the PIN number I can't edit PI info, but I seem to be able to do anything else - and thats, so far, everything I have needed to do to help out. Dr. Richard H. Moore Assistant Vice President for Grants and Sponsored Research Coastal Carolina University Internet: xxxxxx@coastal.edu P.O. Box 261954 Voice: 843-349-2050 Conway SC 29528-6054 FAX: 843-349-2726 ***NOTE NEW AREA CODE*** ====================================================================== Instructions on how to use the RESADM-L Mailing List, including subscription information and a web-searchable archive, are available via our web site at http://www.hrinet.org (click on "Listserv Lists") ======================================================================