21–30 of 89 posts
This is a misunderstanding. The CS agent has access to a plaintext (security question) password that can be used under special circumstances. It must be readable to function.
Earlier quoted context omitted.
Paying by checks through the mail is so annoying and difficult to stay on top of. I can't understand how you would prefer that approach in general -- is there some strategy here that I'm missing? Or is it that you open mail always immediately when you receive it, and minimize changes in address / vacations? My strategy is to have a "disposable" password that you use for low-value purposes, like paying utilities. I as…
Do you really want to bank on your utility to have their shit figured out so you don't pay the utility bill for your whole town? Even if you do entirely get it resolved, that seems like extra hassle when you could just... use a password manager.
1. Even password managers are unreliable, with many popular ones getting hacked in the last 10 years. And I don’t like the idea of storing _all_ my passwords with a single service which may be hacked. I suppose I could just store a subset of my passwords, but that eliminates a lot of the convenience
2. I still find password managers somewhat annoying to use in general. Copy-pasting is disabled on many login forms, so I often would have to manually type an unfamiliar password. And when I’m not using my personal laptop I have to “log in twice” to complete a single intended login - this has historically been fairly common for me, though maybe less common recently
This is a misunderstanding. The CS agent has access to a plaintext (security question) password that can be used under special circumstances. It must be readable to function.
This is a misunderstanding. The CS agent has access to a plaintext (security question) password that can be used under special circumstances. It must be readable to function.
This is bad for anyone who recycles passwords. Most everyone I guess. I’m sure they aren’t the only company to do so I don’t think having an online account with your utility provider is required or smart. Good old postal mail is the way.
Earlier quoted context omitted.
I believe they're suggesting the people storing the plaintext passwords. Who else would it be?
I guess there's no one person to hold accountable. They probably just get a small fine and move on.
This is a misunderstanding. The CS agent has access to a plaintext (security question) password that can be used under special circumstances. It must be readable to function.
This kills the “knowing things about you” vector of phishing and impersonation and make it as secure as any unique and random password.
Often it's a product of repeated acquisitions, where the lowest common denominator across disparate systems is some kind of text-based format.
That said, I'm surprised a customer service agent ostensibly had access to it.
From my own observations (some made during efforts to champion change), industry has gotten better over time. There shouldn't be cases anymore where salted hashes or other alternatives can't be achieved, and I'm pleased to see the public take security and privacy seriously.