News for hackers. Stuff that matters.

A comment on The Correct Way to Validate Email Addresses. Parent comment

Re:The Correct Way to Validate Email Addresses by fps on Thursday September 08, 2016 @11:21AM (#12453829)
My guess is that when you call them on the phone, they ask for your password to validate your identity. Which means it's stored in plain text in their database so that customer service can verify what you said is correct. Maybe they don't want their employees to have to be cursed at by customers.

I can't think of a good way for a business that has an online interface and frequently handles phone calls from customers to validate that they're talking to the correct person. Asking for other personal information can be used by an attacker to compromise multiple accounts via social engineering: http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/

[ Parent | on HN ]
Re:The Correct Way to Validate Email Addresses by Bartweiss on Thursday September 08, 2016 @11:29AM (#12453925)
Someone else in this thread mentioned a company that has customer service type in your password to open your account. So that would be a non-plaintext reason to insist on non-obscene passwords. But it's still terrible, because why the hell is customer service typing in your password.

Pretty much all organizations that allow phone authentication seem to be at risk of engineering attacks. The only ones that manage it send you something verifiable they can ask about like a credit card, and people who really care like the government just send an actual human to your house.

[ Parent | on HN ]
Re:The Correct Way to Validate Email Addresses by WorldMaker on Friday September 09, 2016 @11:35AM (#12463176)
I'd prefer to have an obscenity in my password if a customer service representative is seeing it. That would help communicate my frustration with their system. Saves me from having to voice that same obscenity, most likely.
[ Parent | on HN ]
Re:The Correct Way to Validate Email Addresses by billmalarky on Thursday September 08, 2016 @11:30AM (#12453928)
It doesn't have to be stored in plain text to validate it is correct. The phone operator could enter it into an authentication form to verify it is correct.
[ Parent | on HN ]
Re:The Correct Way to Validate Email Addresses by witty_username on Thursday September 08, 2016 @11:34AM (#12453968)
Customer care clicks a button to create a random temporary token associated with that account and user has to log on and read that token.
[ Parent | on HN ]