News for hackers. Stuff that matters.
Re:Squarespace: They Asked for My Password. by colinbartlett on Friday February 14, 2014 @08:25AM (#7238317)
This is probably just some customer service mistake, not a systematic failure.

Why do people take isolated examples of uneducated, misinformed customer service reps, and blow them into raging complaints damning the entire company? I'm starting to see this regularly. Take a deep breath before you spew out some diatribe on your blog.

Re:Squarespace: They Asked for My Password. by rmrfrmrf on Friday February 14, 2014 @08:34AM (#7238360)
If you understood how customer service business runs, you'd know that this is most definitely a systematic failure. I'm shocked how many people on HN seem to think that customer service reps act on their own volition. And if Squarespace is really that bold as to allow untrained individuals to handle customer service, the first thing they should be trained on is to NEVER ask for a password.

The author of this post is 100% correct in leaving a company she doesn't trust and warning readers that that behavior is entirely unacceptable.

Re:Squarespace: They Asked for My Password. by jcc80 on Friday February 14, 2014 @09:01AM (#7238492)
If you understood how customer service business runs, you'd know that this is most definitely a systematic failure. I'm shocked how many people on HN seem to think that customer service reps act on their own volition.

There is no uniform customer service business or uniform training. Having worked in companies with support departments, there is a wide variance. Some are tightly scripted, others are given almost free reign and simply told to resolve issues quickly. edit: of course, password through email is big no-no.

Re:Squarespace: They Asked for My Password. by scrabble on Friday February 14, 2014 @09:38AM (#7238691)
Password through anything is generally a no-no. Your service should have a way of accessing user accounts without their password.
Re:Squarespace: They Asked for My Password. by erddojo on Saturday February 15, 2014 @02:58PM (#7245076)
No. There are plenty of services where your pw is encrypted locally, so your service provider CAN'T access your account to fix something without your password.

Many of the cloud storage providers do this. You want your files recovered, you'll have to hand over your pw (or not have the problem fixed).

Re:Squarespace: They Asked for My Password. by odonnellryan on Friday February 14, 2014 @09:14AM (#7238567)
They probably only get paid $10 an hour: how much training do you think they might have..?
Re:Squarespace: They Asked for My Password. by gruntmaster9000 on Friday February 14, 2014 @09:18AM (#7238586)
Not a lot, and that’s the point. If the company can’t dedicate resources to train these people, they aren’t worth sticking with.
Re:Squarespace: They Asked for My Password. by odonnellryan on Friday February 14, 2014 @10:22AM (#7238959)
Sure thing. But a lot of companies (lots and lots that you still use I'm sure) have little to no support.
Re:Squarespace: They Asked for My Password. by pdpi on Friday February 14, 2014 @10:26AM (#7238987)
Which is fair enough. As and when you find out that their support sucks, you look for better alternatives.

Just because you're still using some other services with crap support, doesn't mean that you shouldn't try to get better alternatives when you do find unacceptable behaviour.

Re:Squarespace: They Asked for My Password. by odonnellryan on Friday February 14, 2014 @10:37AM (#7239058)
No, I definitely agree. I just wanted to bring attention to the problem: how do you supply support?
Re:Squarespace: They Asked for My Password. by viraptor on Friday February 14, 2014 @08:30AM (#7238339)
Oh no, it's definitely the company's fault. Any real service where support may need to get involved will provide the support people with an admin interface or a way to login as the user without their password. That's the standard way to do it.

If they didn't provide that and didn't explicitly say "never ask for password", that's really the company's fault.

Re:Squarespace: They Asked for My Password. by odonnellryan on Friday February 14, 2014 @09:17AM (#7238583)
Where's the window's admin interface to log in as another user...?
Re:Squarespace: They Asked for My Password. by Ensorceled on Friday February 14, 2014 @09:24AM (#7238615)
"su - user" has existed for at least 30 years.

Oh, right, Windows. Using Windows as a counter point to any argument on best practices is silly. But even then, as your domain admin, I can reset your password, login as you and then reset a new temporary password for you. I have done this and would never ask a user for their password. Even on windows.

Re:Squarespace: They Asked for My Password. by mschuster91 on Friday February 14, 2014 @09:42AM (#7238717)
...which wipes out access to my OS-level encrypted files, thank you very much dear admin
Re:Squarespace: They Asked for My Password. by Ensorceled on Friday February 14, 2014 @09:50AM (#7238760)
Which, again, is another reason not to use windows...
Re:Squarespace: They Asked for My Password. by odonnellryan on Friday February 14, 2014 @10:21AM (#7238955)
True, but, I think the most-used software isn't a "bad" example to use in an argument.
Re:Squarespace: They Asked for My Password. by Ensorceled on Friday February 14, 2014 @11:52AM (#7239458)
I think it is when that most-used software is notoriously insecure. Certainly when used as a standalone argument. But hey, minor point :-)
Re:Squarespace: They Asked for My Password. by viraptor on Friday February 14, 2014 @10:12AM (#7238909)
1. I wrote service as in service provided on the web, not software. I'm sure online office (360, live, or whatever the name is this week) support has the ability to get to your documents though.

2. There's runas.

3. There's lots of examples of software that allows you to use the system remotely. Some of them have signatures in the virus databases, some don't.

Re:Squarespace: They Asked for My Password. by odonnellryan on Friday February 14, 2014 @10:23AM (#7238970)
> I'm sure online office (360, live, or whatever the name is this week) support has the ability to get to your documents though.

I have an admin account for an Office365 subscription, I can absolutely NOT impersonate a user. From what I know, Microsoft can not either.

Runas doesn't let me "see the error the user has"

Re:Squarespace: They Asked for My Password. by viraptor on Friday February 14, 2014 @12:09PM (#7239549)
You're assuming that admin account has the same or more privileges as a local MS's support account. Is there a reason for that?
Re:Squarespace: They Asked for My Password. by odonnellryan on Sunday February 16, 2014 @10:07AM (#7247783)
Well, you assumed a lot of stuff in your post, too..

But yes. Microsoft will actually reset your password, or ask you for it, to troubleshoot O365 problems. Very standard.

Re:Squarespace: They Asked for My Password. by skywhopper on Friday February 14, 2014 @09:47AM (#7238743)
Re:Squarespace: They Asked for My Password. by odonnellryan on Friday February 14, 2014 @10:36AM (#7239054)
(I know there's software for this) but that doesn't let me use the environment as the user. Lots of times, things are profile related.
Re:Squarespace: They Asked for My Password. by sivetic on Friday February 14, 2014 @08:46AM (#7238426)
Because it only takes one uneducated, misinformed customer service rep to cause a (small or big) security breach.
Re:Squarespace: They Asked for My Password. by RALaBarge on Friday February 14, 2014 @08:33AM (#7238354)
I think one of the comments someone left on the blog itself rings true:

"Wow, you are a hell customer."

I'm willing to bet Squarespace is happy the OP is leaving their service, I know I would be if I were in their shoes.

Granted, it is a case of bad support, but as Colin mentions, it is likely an issue with an under trained new hire, not a systematic failure.

Re:Squarespace: They Asked for My Password. by prof_hobart on Friday February 14, 2014 @08:45AM (#7238424)
You don't think there's a systemic failure if under-trained new hires are on the front line requesting passwords?

If they've not been educated about not doing that, there's a fair chance they aren't going to be too smart around other big security issues either - such as resetting passwords with very little validation of whether it's the genuine customer requesting it or not.

Re:Squarespace: They Asked for My Password. by offmango on Friday February 14, 2014 @09:16AM (#7238577)
Tough customers, once won over, can prove to be extremely loyal. And in this case, the customer did Squarespace a favor by pointing out a flaw in their customer service approach. Undertraining can in fact be a systematic failure.

Unless the customer is causing you a major amount of aggravation or costing you money, you shouldn't be happy to see one go.

Also, FWIW, I don't think citing a comment in which the commenter calls the OP an "egotistical bitch" twice is good support for an argument.

Re:Squarespace: They Asked for My Password. by RALaBarge on Friday February 14, 2014 @12:01PM (#7239502)
Totally agree, but if the person who has an issue with your service, their first move is to blog and submit the post to HN, then likely they are going to be a shitty customer to deal with.

As for cherry picking that quote from the comments, that is fair. I did not read his sexist diatribe, i just read his opening statement and concurred.

Re:Squarespace: They Asked for My Password. by rmrfrmrf on Friday February 14, 2014 @08:37AM (#7238382)
Hmmm smells like the HN misogynists are out again. Someone should really do a sentiment analysis on HN comments based on author gender.
Re:Squarespace: They Asked for My Password. by DanBC on Friday February 14, 2014 @09:15AM (#7238569)
She makes a reasonable point. Someone comments

"Wow, you are a hell customer. In the future, set a temporary password. They were trying to help you and you have to be a mouthy egotistical bitch. I'm sure they're happy to see you go. As someone in customer support, I'm sure they're happy to see you go. Egotistical hipster bitch."

For not wanting to give her password to customer support she is somehow a "mouthy egotistical bitch", a "hell customer", etc.

And yet you get down voted for mentioning the misogynist word?

Re:Squarespace: They Asked for My Password. by xauronx on Friday February 14, 2014 @09:02AM (#7238500)
If it helps anything, I came to the same conclusion and didn't realize the author was a female until your post brought it to focus.
Re:Squarespace: They Asked for My Password. by Ensorceled on Friday February 14, 2014 @09:29AM (#7238645)
Well, it helps that you didn't call her an "egotistical bitch" :-)

You can agree that she might be wrong but I think the sentiment is that some of the people that are disagreeing with her are being specifically sexist in their method of disagreement.

Re:Squarespace: They Asked for My Password. by waylandsmithers on Friday February 14, 2014 @09:55AM (#7238790)
She is no hell customer.

A hell customer would call them up, yell, demand answers, and refuse to hang up until the situation was "fixed" to her liking, threaten to sue and call CNN, etc.

Most support agents are probably ok with seeing a staunchly unsatisfied customer simply leave and allow them to help people who want to be helped.