title: What implications are involved in password change over the phone?
body: <p>An application I maintain offers a standard password reset script. My employer wants to add a tool for our support reps to set the password manually to something they pick themselves, and give the password to the customer over the phone. </p>
  
  <p>Security in my application is expected to be top notch, so this sets all sorts of warning bells in my head.</p>
  
  <p>Aside from the obvious no-no of allowing support staff to know customer passwords, What other security implications should I be aware of in this scenario? In the case of fraud, would this increase our legal liability?</p>