Hacker News Reader

Comment by suresk | Hacker News Reader

This doesn't sound good, but it got me thinking.. How do you verify someone is who they say they are in situations like this?

As we've seen with recent breaches, the last 4 digits of your CC # aren't incredibly hard to find out. "Secret" questions and answers are generally quite poor, in that very few of them don't suffer from laughably small keyspaces or rely on semi-public information. Passwords almost seem like the least bad option.

I get that giving a password to a human isn't a very comfortable feeling, but if you don't trust the CSR to not misuse the password, do you also not trust the developers to not have put in something to grab your password one of the various times you enter it into a web application that they control?

View on HN

Like this:

  1. Login to your account
  2. Click on "Request Support"
  3. In the dropdown "Grant access to support for:" choose "30 minutes"
  4. Submit the form
  5. The site displays a phrase such as "banana black puzzle lightbulb"
     as well as a phone number to call or a support form to submit.
     The words are chosen from a list of 256 common, unambiguous words
     making the odds of guessing 1 in 4 billion.
  6. The CSR, upon using this phrase, gets 30 minutes access to your 
     account through their support portal only. All CSR actions are 
     logged in your account which you can view.

Of course, this takes development time away from features. It's much easier to just ask for the password and login using the same interface users use.

Assuming that all you need to verify is that the person on the phone knows that account name and password, one way that would not be too difficult to implement would be to have a way for support to mark the account with a random 8 digit number. The support person does this, and then tells the customer to log in to their account management page. There should be a link there that shows the random 8 digit number. The customer then reads this to the support person over the phone.

Something like that would certainly work - I was thinking a one-time code could be emailed to the email address on the account, but either way would be fine.

Given the relative simplicity, I wonder why nobody (at least that I know of) has implemented something like this?

This is how PayPal support works: you use the website to get a random six-digit "customer support PIN" which you then dial in when you connect to their system.

Media Temple operates this way, as well. I like this approach, as I can never remember those "4-digit account pins" (looking at you, AT&T), and I'm happier knowing any given pin is only usable for the next hour, anyway.

I think this is the best way actually, and I've thought of it for the startup I work for, it'd be a really good authentication technique which could replace the password for support transactions with less/none of the security implications.

If you call them, you can be almost certain that they're genuine. It's really difficult to hijack a phone number without detection, and then to staff it for random calls suggests a level of dedication difficult to find.

So if they call you, never give anything related to security. Always call them back on a publicly verifiable phone number before giving security or very private info.

an excellent company I used to use for hosting (who were later swallowed by by a not so excellent company) had a great solution to this. You'd log into your account and from there you could generate a single use token that you'd read to the csr.

Easy to verify someone, ask them for the j'th and k'th character of their password along with their post code.

I absolutely understand your point - but I think this is the worst of many bad solutions. It encourages bad habits and encourages people to think this kind of behaviour on websites is okay.

As for your second point, that is true - we just have to trust that that isn't happening, but that trust is implicit in day-to-day use of the internet.

Reply on news.ycombinator.com