Rackspace passwords are visible to customer service

"- so if a user account database is stolen somehow, the malicious thief would not have access to convenient info like email/username/cleartext password."

What if the secure, non-public tool is also stolen?

Sorry, but I think this is the phone equivalent of insisting that you set a password using uppercase, lowercase, digits, symbols, at least 20 characters long and changing every 3 days. People are just going to start using obvious things or writing them down.

True story: A few months ago, I took out a new credit card. During the application process, including activating phone and Internet access, I was asked for something like sixteen different pieces of personal/security information. The first time I wanted to call them a few days later to check something was now ready, I was asked for my "pass code". I had no idea which of those pieces of information that was, so Call Centre Guy says not to worry, he can verify me via other details. He runs through a series of questions, at least one of which makes no sense in the circumstances (in fact, that was the reason I was calling). At the end, he says he's sorry but I've failed security and he has to hang up now. All he can say is that I haven't provided the required answer to all of the questions. I tried to go on-line, and was asked to enter some memorable information. Apparently, I gave them three different things during sign-up and any one of them would do. No doubt I chose someone's birthday, etc., but of course I had no idea who and there was no kind of prompt. So I couldn't get in over the Internet either. Finally, I gave up and went back into the branch, where the staff had been helpful and efficient while I was setting things up to start with. They called through to a special number... which transferred to the same call centre and resulted in the same series of security questions, even though I was sitting in a secure area of one of their branches, with an employee who had already authenticated themselves, and who had seen my passport and driving licence two minutes earlier (which means they had access to two photos, two signatures, and my current address as a minimum). I gave exactly the same answers I had given to the previous guy, explained in exactly the same way why one question didn't make sense, and was told that was fine and how could he help?

When I call my other credit card company, they ask for my six-digit DoB and typically my current credit limit to verify before doing anything significant.

My business account needs a single password for everything, and for extra security provides a device where you push a button to generate a six-digit code that changes every few seconds.

Two of these have the right approach. The one that uses separate security information for everything and all kinds of different types of validation is not one of them.

Anyway, the managed folks ask for your portal password and a challenge question (high school mascot). In the 4 years I've used them, they have never asked for a root password to one of my boxes.

And, BTW, Softlayer does ask for your machine's root password in their support ticket form.