11–16 of 16 posts
Earlier quoted context omitted.
Sounds like a security flaw ripe for social engineering
Customer support by itself tends to be a security flaw ripe for social engineering.
Earlier quoted context omitted.
Customer support by itself tends to be a security flaw ripe for social engineering.
Phone support can be tricky yes, but there are other ways to identify the caller without storing their password in plaintext
Earlier quoted context omitted.
Phone support can be tricky yes, but there are other ways to identify the caller without storing their password in plaintext
Callbacks? Users PII? There's really no good ways to do phone verification. You can't use any kind of shared secrets as people forget those.
But it also depends on the realm. Before the saas craze, a lot more support was performed in-house meaning you didn't have the same scale of problem.
How do you know it's actually plain text? There are plenty of 2-way encryption methods out there. Do you work there? If so, are you willing to lose your job over it? These sorts of leaks can have devastating effects on the company/customers. You should also think about the employees that work there as well. Are you willing to risk their jobs in the event that the company loses money?
What legitimate use case is there for implementing a 2-way encryption method over a hash function for passwords?
Earlier quoted context omitted.
Callbacks? Users PII? There's really no good ways to do phone verification. You can't use any kind of shared secrets as people forget those.
My bank uses an automated system to verify a pin (ie the operator transfers you to confirm identity then you come back) But it also depends on the realm. Before the saas craze, a lot more support was performed in-house meaning you didn't have the same scale of problem.
Earlier quoted context omitted.
My bank uses an automated system to verify a pin (ie the operator transfers you to confirm identity then you come back) But it also depends on the realm. Before the saas craze, a lot more support was performed in-house meaning you didn't have the same scale of problem.
Verify a pin? But that's still something you have to remember, not providing support for users who have forgotten their passwords doesn't tend to be an option.
Also as I said - this was much less of an issue when companies maintained IT departments and installed software. It's much easier to verify that Julie on the phone really is Julie when it's an internal support mechanism.