The Rackspace Cloud CSR could have just been lying.
Or it could have been anyone else in the middle:
You: My password is "foo" Random person: Yes, that's exactly what the screen says.
Little do you know, there is no screen.
Rackspace passwords are visible to customer service
11–20 of 41 posts
Re: Rackspace passwords are visible to customer service
#12Does the author of this article not know about 2-way encryption? It can be used to store encrypted passwords in a database and the original value can be retrieved.
Letting a random employee to see your password on demand is just as bad as storing it in plaintext. Now the employee knows you and knows your password - for most people that means free access to their mail account, which means free access to all their accounts.
security 101 - use different passwords for everything.
Re: Rackspace passwords are visible to customer service
#13I asked a Rackspace rep about this. Here is the real deal:
- passwords are NOT stored in cleartext
- however, passwords are visible to customer service via a "secure, non-public tool"
- the reason for this is because "people generally prefer to give out a password to authenticate themselves [over the phone] than portions of the billing information"
- so if a user account database is stolen somehow, the malicious thief would not have access to convenient info like email/username/cleartext password. (However if a customer service rep is the bad guy, you're still in trouble since they have access to the tool.)
- at some point, Rackspace intends to "removing CSR access for SAS-70 purposes and moving to something like a challenge/response like the Managed division uses." AFAIK SAS-70 is some kind of audit regulation, but the wikipedia article put me to sleep after reading the first sentence.
Re: Rackspace passwords are visible to customer service
#14Earlier quoted context omitted.
Letting a random employee to see your password on demand is just as bad as storing it in plaintext. Now the employee knows you and knows your password - for most people that means free access to their mail account, which means free access to all their accounts.
security 101 - use different passwords for everything.
1password
Re: Rackspace passwords are visible to customer service
#15Earlier quoted context omitted.
Letting a random employee to see your password on demand is just as bad as storing it in plaintext. Now the employee knows you and knows your password - for most people that means free access to their mail account, which means free access to all their accounts.
security 101 - use different passwords for everything.
Good idea in theory. Unfortunately every serious person doing programming / administration / ... will have at least 20 accounts on the internet (probably underestimated!: email, other email, HN, sourceforge, github, facebook, own pc, own pc admin, vps, stackoverflow, etc. etc.)
At some point it's not possible to remember them all anymore... You have a choice of storing them with master password (now I can get all of them in one file), using the same one, having a password scheme (like usualpwd_HN, usualpwd_gmail, ...) or ... ?
Edit: what I started doing is setting random password that I will not remember and just requesting a reset when I get logged out.
Re: Rackspace passwords are visible to customer service
#16Anyone that's ever logged into their control panel knows the control panel can show you your password with a button click.
If you're a Rackspace customer, you trust them run your network fabric and your hardware. They don't need your password to see what you're doing, but you may as well trust them with that too.
Speaking of trust -- if your machine password gives a Rackspace CSR access to your app's private data, you're just as guilty as you're accusing them of being. You're not storing your private data in the clear, are you?
(As for why they might do this: Most users aren't sophisticated enough to use a password generator and manager, making "What's my password again?" a common support question. Providing the "Show me my password" function in the web control panel means a CSR doesn't have a job reason to look at it. And even if they do, cloud customers already trust Rackspace support with the reboot switch, and for that matter, with the "delete this whole image and all its backups" button.)
Re: Rackspace passwords are visible to customer service
#17Earlier quoted context omitted.
security 101 - use different passwords for everything.
Good idea in theory. Unfortunately every serious person doing programming / administration / ... will have at least 20 accounts on the internet (probably underestimated!: email, other email, HN, sourceforge, github, facebook, own pc, own pc admin, vps, stackoverflow, etc. etc.) At some point it's not possible to remember them all anymore... You have a choice of storing them with master password (now I can get all of…
You could use a password scheme for sites you don't really care much about and stronger separate passwords for important and often used sites.
I do this and it works out well and if you use the important sites enough you will and do remember your strong passwords but for the ones you don't you always can reset your password by email which isn't that inconvenient if you think about how often you are accessing the website that you cannot remember your password.
Re: Rackspace passwords are visible to customer service
#18I asked a Rackspace rep about this. Here is the real deal: - passwords are NOT stored in cleartext - however, passwords are visible to customer service via a "secure, non-public tool" - the reason for this is because "people generally prefer to give out a password to authenticate themselves [over the phone] than portions of the billing information" - so if a user account database is stolen somehow, the malicious thie…
If they really don't want to verify hashes, is it really that hard to do a secure, partial information authentication system?
- set a separate password for over-the-phone stuff
- N specified letters from the password are requested by the customer service (3 - customer service puts them into the system and gets a yes/no response
I don't reveal the root password to the person, they get good enough proof that I know the over-the-phone secret.
Alternatively, set a separate phone password and just verify it against the hash. I don't see any excuse for anyone to know my root password in full.
Re: Rackspace passwords are visible to customer service
#19Earlier quoted context omitted.
security 101 - use different passwords for everything.
Good idea in theory. Unfortunately every serious person doing programming / administration / ... will have at least 20 accounts on the internet (probably underestimated!: email, other email, HN, sourceforge, github, facebook, own pc, own pc admin, vps, stackoverflow, etc. etc.) At some point it's not possible to remember them all anymore... You have a choice of storing them with master password (now I can get all of…
...or... writing a simple script that given a key, generates you a password based on it.
I probably have 50+ passwords at least, and every one is different. I just run my little script with a "key" and it tells me the password.
And of course browsers remember them anyway.
eg
./get_my_password.sh mygmail
./get_my_password.sh server_1_mysql_root
Re: Rackspace passwords are visible to customer service
#20Earlier quoted context omitted.
security 101 - use different passwords for everything.
Good idea in theory. Unfortunately every serious person doing programming / administration / ... will have at least 20 accounts on the internet (probably underestimated!: email, other email, HN, sourceforge, github, facebook, own pc, own pc admin, vps, stackoverflow, etc. etc.) At some point it's not possible to remember them all anymore... You have a choice of storing them with master password (now I can get all of…
I used a password manager, and I have a different password for every single service that I'm signed onto.
If you're using similar passwords for all the services you're signed onto, it's pure hypocrisy to turn around and criticise Rackspace for "poor security". The single point of failure is you.