Slashdot Log In
Changing Customers Password Without Consent
Posted by
samzenpus
on Wed Aug 27, 2008 11:09 PM
from the leave-my-words-alone dept.
from the leave-my-words-alone dept.
risinganger writes "BBC News is reporting that a customer had his password changed without his knowledge. After some less than satisfactory service the customer in question changed his password to 'Llyods is pants.' At some point after that, a member of staff changed the password to 'no it's not.' Requests to change it back to 'Llyods is pants,' 'Barclays is better,' or 'censorship' were met with refusal. Personally I found the original change funny, like the customer did. After all, god forbid a sense of humour rears its ugly head in business. What isn't acceptable is the refusal to change it per the customer's requests after that."
Related Stories
This discussion has been archived.
No new comments can be posted.
Changing Customers Password Without Consent
|
Log In/Create an Account
| Top
| 435 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Plaintext passwords? (Score:5, Insightful)
Re:Plaintext passwords? (Score:5, Funny)
And I thought I had a shot at getting this in first...
Maybe he should make his new password "Lloyds security is pants"
Parent
Re:Plaintext passwords? (Score:5, Informative)
It's a voice password. It is the employee on the phone that has to enter and verify the voice password. It is probably not being stored in plain text and it is entirely appropriate, and indeed required, that the administrative interface view the voice password as entered by other employees.
The only concern here is that an employee changed the voice password without authorization. Anytime an employee changes a password there should be records of the interaction. Call logs, voice logs, notes, etc.
Now in this case, the choice of the password might be deemed offensive. However, it seems that there was no clear and consistent policy enforced as to what a voice password could be.
Parent
Re:Plaintext passwords? (Score:5, Insightful)
What, you mean like bank fees?
What, you mean like the legislative requirement that banks give depositors access to their funds?
No, they don't. They doubly don't if it means banking customers' financial services are interrupted.
Does your phone company, who own the systems that your phone calls go through, have the right to let their operators listen in on your conversations and interject with witty remarks every now and then?
Parent
Re:Plaintext passwords? (Score:5, Funny)
Does your phone company, who own the systems that your phone calls go through, have the right to let their operators listen in on your conversations and interject with witty remarks every now and then?
I live in the U.S. and am offended by the implications in your statement. Of course they have the right! How else would they find the terrorists?
Parent
Re:Plaintext passwords? (Score:5, Informative)
I think you missed my point. There were no call logs, voice logs, notes, that identified an interaction with the customer when the voice password was changed.
The fact they know which employee modified the password means that anytime customer information is changed they log which employee was responsible for it. That's good policy.
So since the voice password was changed, and there are no records of the customer calling in and asking for it, the employee was disciplined.
I thought that was clear from my post.
Parent
Re:Plaintext passwords? (Score:5, Interesting)
Actually, LTSB verification involves being asked for (three, I think) letters from your password / passphrase. I believe that the operator has no access to the letters involved --- they are prompted to ask for three and eight, type them in, and now know what they are. If you don't know, they don't either: the letters aren't displayed to the operator. Online, you supply a username (which is related to you, not to your account) and password, and are then prompted for three characters from a passphrase as pull-down menu items (presumably to make key-loggers a little less useful). The telephone and online systems use different passphrases.
Now of course this isn't flawless: there are a lot of attacks one can envisage, mostly involving operators always asking for different letters --- ie if they already have three, five and eight, and are prompted to ask for three, five and nine, they ask for four, six and nine, supply three and five from their previous knowledge and now have six letters instead of the four they would otherwise have. By this technique they can get the password in n/3 attempts, less if (as is likely) you don't need all the letters to see what the whole word/phrase is. It's a thin attack given the chances of you arriving at the same operator, or the operator's confederate, that many times, but might be possible as a large conspiracy by a corrupt call centre (LTSB have in recent months re-on-shored all their call centres; make of that what you will). If you fail to authenticate, for whatever reason, you're asked for the same characters next time, so an attacker cannot make repeated attempts hoping to be asked for characters they already have if they don't get a favourable set the first time.
Some things about this story don't ring true, by the way. Firstly, LTSB have not, to my knowledge as a customer, had a limit on the length of pass phrases either for telephone banking or on-line banking as short as is claimed. The on-line `memorable information' (ie password) is six to fifteen characters, spaces not permitted, and I can't believe the voice system is different.
There are some things that could be improved. You can change the greeting between given name, given name plus surname and a few other options, but you can't have a custom greeting. That's a powerful phishing prevention mechanism: if I can customise my bank's website to greet me, after supplying my password but before supplying my selected characters from the passphrase, with a picture I supply (say) then that massively ups the problems a phisher faces. I have my passphrase as six random characters (ie knowledge of five doesn't provide the sixth) so that if I'm ever asked for character seven or greater I know something bad is happening, but it's not ideal. But the rest they do well: initial contact URL is https and won't work as http, ie http://online.lloydstsb.co.uk/ [lloydstsb.co.uk] doesn't answer, so anyone bookmarking it will bookmark the https. Menus don't accept keyboard accelerators. More if I could think of it before my first coffee. I checked it through pretty thoroughly before signing the ts and cs, and I'm reasonably happy.
ian
Parent
Re:Plaintext passwords? (Score:4, Insightful)
Actually, LTSB verification involves being asked for (three, I think) letters from your password / passphrase. I believe that the operator has no access to the letters involved --- they are prompted to ask for three and eight, type them in, and now know what they are. If you don't know, they don't either: the letters aren't displayed to the operator.
In this case, the system seems to have a hole somewhere:
Somehow the operator was able to substitute another password. His choice of new password indicates that he could read the entire old password.
Unless there are some other safeguards in the system that were not mentioned in TFA, I would be seriously concerned about criminal operators abusing my account (hypothetically speaking, I'm not a customer at LTSB).
Parent
Re:Plaintext passwords? (Score:5, Funny)
When you think a 'plc.' can be offended you are antropomorphizing abstract legal entities. Don't do that; they really hate it.
Parent
Re:Plaintext passwords? (Score:5, Funny)
Lloyds [lloydstsb.com] is a plc [wikipedia.org].
Go search for antropo [quotegarden.com] and see what to offend [merriam-webster.com] means.
Now try to imagine an offended Plc.
And hand in your geek card.
Parent
Re:Plaintext passwords? (Score:5, Informative)
From the article it sounds like a voice code phrase to authenticate yourself over the phone. They staff has to be able to see it to verify it. It isn't a computer password.
Parent
Re:Plaintext passwords? (Score:5, Funny)
From the article it sounds like a voice code phrase to authenticate yourself over the phone. They staff has to be able to see it to verify it. It isn't a computer password.
"I am the systems administrator. My voice is my password. Verify me."
Parent
Re:Plaintext passwords? (Score:5, Funny)
Yes, my voice password is "billy'; drop tables;", type it in muppet!
Parent
Re:Plaintext passwords? (Score:4, Funny)
No, No, No. "My voice is my passport verify me" :D
Parent
Re:Plaintext passwords? (Score:5, Interesting)
I've had more than one website email me my password if I hadn't logged in after a week or two. Because obviously I wasn't logging in due to having forgotten the same password I use at half the websites on the internet, rather than the site sucking. Suffice to say, I've deleted my accounts at all sites where that's occurred. I wouldn't be at all surprised to see several of them vulnerable to SQL injections and I'm sure all of them did nothing but flip the 'account_active' column bit, but I felt better for a few minutes at least.
Wordpress has a pretty good forgotten password system - it emails you a unique link (something like changepass.php?user=firehed&verify=asdf903jfo2i3jf) and you get your new password form. It's never revealed in plaintext. I hope more sites adopt something along those lines - seeing my password in plaintext anywhere always freaks me out a bit. Then again, I've seen it hashed as md5 and sha1 enough times that I could spot probably my account in a 'SELECT id, pass FROM users' result.
I'm still a bit curious as to how banks haven't yet found a better system for getting you your initial ATM PIN when you get a new card than simply sending it separately from the card. Shouldn't they have some automated dial-in where I punch in the auth code they send me and the last four from my SSN (or MMDD birthday, whatever) as a verification code? If someone is stealing your mail looking for a new card, it wouldn't be difficult for them to also grab that 'discreet' envelope with that starter PIN.
Security is really quite pathetic these days. No wonder we keep hearing about millions of customer records being lost.
Parent
Re:Plaintext passwords? (Score:4, Informative)
My bank has a password to verbally verify over the phone. It's the street I grew up on, so I just say Cottage Rd. But seriously, I have to say my street name every time, and I assume the operator is looking at it to verify. I doubt they're going to type it in an verify the hashes.
Parent
Re:Plaintext passwords? (Score:5, Funny)
Parent
Re:Plaintext passwords? (Score:5, Informative)
When you change or set your password into a well-programmed website, it hashes the password (hopefully with a one-way algorithm), and stores the hash. When you enter your password in the future, it hashes what you enter with the same algorithm originally used, and compares the hashes, to see if they are the same. If they are, then the password is the same, or you've managed a 1 in eleventy billion chance at picking an entry that has a hash collision with your password.
GP is assuming that the mentioned institution uses this sort of password protection system, and when the operator asks for your password, they type it in and click "Check Password", and wait for the program to say either "Password Correct" or "Password Incorrect". This would mean that the hashes are being compared.
Of course, this is not a given.
Parent
Re:Plaintext passwords? (Score:5, Funny)
I prehash all my passwords. That way only the hash of the hash is stored in their db. Its more secure that way.
Parent
Re:Plaintext passwords? (Score:5, Interesting)
Parent
Re:Plaintext passwords? (Score:4, Interesting)
As long as you have access to something that can generate MD5 hashes (any system with OpenSSL or GNUTLS installed, including any *NIX machine, any Mac, and some Windows machines) you can trivially regenerate your password. If you wanted to use the same password for mybank you would use hash of 'mybankpassword' which is '4281a3b1440b23b1106655dfeb849057'. Given either of these, it's very hard to recover the original input. It's a bit easier if you know that the format is {site name}{password}, but you could easily do something different, like interleave the letters, giving the hash of 'pmaysbsawnokrd'.
Parent
Re:Plaintext passwords? (Score:5, Funny)
Parent
Re:Plaintext passwords? (Score:5, Informative)
Parent
Re:Plaintext passwords? (Score:5, Insightful)
Uhm..what?! You don't store passwords in plain text, full stop. One-time passwords, alright. Generate one based on your bank card, and give it to the operator. It can't be used again. But a regular password? No way.
Parent
Re:Plaintext passwords? (Score:4, Funny)
What are you supposed to do, SHA-1 hash it in your head before reciting the hex digits over the phone to the operator?
Parent
Re:Plaintext passwords? (Score:5, Funny)
Parent
Re:Plaintext passwords? (Score:5, Insightful)
If the operator ever needs me to prove my identity, I am asked to provide eg the 4th & 5th character, not the whole thing. Sounds like Lloyds needs to update their security procedures!
My bank als asks me for two letters from my password, and my bank is Lloyds!
How do you know for sure that your bank's operator can't see the full password when they're asking you for two letters?
Parent
It's still retarded security (Score:5, Interesting)
So basically every single operator they've ever employed, can find or just remember your username _and_ password if they want to. And who's to stop them from calling after hours and pretending to be you?
And you don't see the problem yet?
How about: when you tell that guy your password, he types it on the computer, which compares it to a hashed (and salted, please!) value in the database. There we go. It wasn't that hard, was it?
Of course, now when you talk to an operator, you tell them your password. So now we're back to problem 1, albeit with less people having access to it.
So, better yet, how about making you type it on the phone pad? Then their PBX can extract any such keypresses and send them directly to the computer. There is no need for the human operator to ever hear or read that sequence.
So basically, you can jolly well stop pretending that crap security is anything else. Yes, it may require some 5 minutes of thinking to solve those problems, but they _are_ solvable.
This kind of thinking inside the box (basically, "it's been done so before, so I guess we'll have to do the same"), and throwing your hands up in defeat each time it requires more thought than applying verbatim what you already know, is the real problem with security nowadays. Most people don't even bother trying to think about what could go wrong, and how (if at all) it's preventable.
Parent
Re:It's still retarded security (Score:5, Funny)
And who's to stop them from calling after hours and pretending to be you?
Perhaps the fact the call center would be closed after hours?
Parent
Re:It's still retarded security (Score:5, Interesting)
I worked for a Staples Call Center for awhile. One night I took an order from some guy. At the end I asked for his credit card number, name on the card, and the billing address. He hesitated on the last question, and stated, "But if I give you all that information, there's nothing to stop you from making an order using my credit card." I had no idea how to respond to this. Yes, you are giving me all the info I need to make a purchase via credit card, because that is what you are doing. So, I really don't see this password thing as a problem. If money disappears from a customer's account, those employees will the the first suspects. They are all probably smart enough to realise this and won't be stealing the information. I, and hundreds of other employees, could have walked out of the Call Center with hundreds of people's credit card info every day.
Parent
That's still a rather fragile assumption (Score:4, Insightful)
That seems to me like a very fragile assumption.
Yes, you'd think that most people are smart enough to not do stuff where they could end up in jail, but about 1% of the population of the USA _is_ currently in jail. You'd think that most people are sane enough, but 0.4 to 0.6 of the population are schizophrenic. You'd think that most people are nice enough to their fellow human, but about 1 in 30 qualifies as sociopath, and 1 in 100 as outright complete psychopath.
You don't take those precautions against most of those call centre employees which are honest, sane, smart and nice, like you were. You take them against the schizophrenic dude who'll sell that data because the ghosts threatened to suck his soul through his nose if he doesn't. You take them against the disgruntled sociopathic admin who wants to go out with a bang. (See for example the recent news about the guy who locked a city administration out of their computers.) You take them against the idiot who'll sell an old computer on EBay without first erasing the database files or backups off it. (See the recent story.) You take them against the irresponsible (if well meaning) insurance/investment/etc salesman, who'll copy the whole damn customer database on his laptop so he can show a snappy chart to a potential customer. You take them against the idiot rent-a-coder who'll zip your whole database and post it on the web, when asking for help with some trivial formatting problem. (Yes, one dude did exactly that. Twice.) You take them against the irresponsible boss who'll copy that whole damn database on an USB stick, and give it to some programming contractor so he doesn't have to work on-site. And then said contractor loses the stick. (See the recent leak in the UK.) You take them against the irresponsible "tech savvy" guy, who'll open an insecure tunnel right through your firewall, so he can work from home, and thinks that nobody will guess the port. Etc.
It's not just you call centre guys who can see those plaintext passwords, you know. There's a whole lot of people who might end up seeing that data, some of which you'd never even think about off the top of your head. E.g., that eastern european janitor who was emptying the dustbins while you were looking up someone's plaintext password.
Security is about trying to prevent as many of those as you realistically can. Just because you call-centre guys get to hear the password as plaintext, is no reason why everyone in IT or with enough clue to run an SQL query should also be able to get to them.
Parent
Re:That's still a rather fragile assumption (Score:5, Interesting)
Fragile assumptions are the building blocks of society.
Parent
Re:It's still retarded security (Score:5, Funny)
Better yet, read your public key to the teller, who then generates some random data, encrypts it with your public key and the bank's private key, then reads out both the cipher text and their public key over the phone to you. You then decrypt the data, and re-encrypt it with their public key plus your private key, and read the cipher text back to them, over the phone.
Of course, you'd want to call them first thing in the morning, so you can finish the transaction before close of business.
For efficiency, you can both keep a copy of each other's public keys after the first transaction, but you'll then need to read the contents of your respective revocation lists to each other, to make sure they're still valid.
Parent
Re:Plaintext passwords? (Score:5, Funny)
RTFA, its a phone banking password
So, unless I misread TFA, we now know that Mr. Steve Jetley from Shrewsbury has a phone banking account with Lloyds, and is unable to change his password to anything else than "no it's not". Mr Jetley said he was still trying to find a suitable password which met the conditions.
Excuse me, I have to make a phone call...
Parent
Legal Problems (Score:3, Insightful)
Re:Legal Problems (Score:5, Interesting)
I just love the hypersensitivity out there. I was on a project years ago where there were duplicate records on companies. One fellow that I worked with wrote a drag and drop application to eliminate duplicates. The user would drag the "good" record over an icon for the good company record and drag the "bad" record over the icon for the bad company record. The good company icon was a building in white with a halo over it and the bad company icon was a building in red with horns. I told him that someone with no sense of humor is going to tell him to change the icons. Sure enough, he was told to change the icons so as to not potentially offend someone's religious faith.
Parent
Sounds to me like (Score:1)
but that's just me
Clarifying for Americans (Score:5, Informative)
It is also slang for rubbish (that's "crap" for Americans.)
This doesn't speak well for the state of British underwear, but whatever.
Re:Clarifying for Americans (Score:5, Funny)
Does anyone else find it quaint when yanks try to comment on the English language?
They always manage something that is nearly completely wrong, but right enough to see where they were going before they were distracted by something to eat or a TV.
Parent
Re:Clarifying for Americans (Score:5, Funny)
Wow, so basically your world view is that there are people from the UK and there are people from the US and no-one else exists?
I guess that's almost better than the average American's grasp of geography.
Parent
Re:Clarifying for Americans (Score:5, Insightful)
American here. No, that is not anywhere NEAR the average American's grasp of geography. You're giving them far, far too much credit. Most of my countrymen below the age of about 30 have no clue about anything other than the area of the US they live in, and some vague notion of Africa being poor, and Iraq being "over there". They can't even pick out all the states, much less find Iraq on a map. They *might* be able to pick out the continent of Africa, but they'd probably be looking for a single country instead.
Our public school system has turned an entire generation into morons, who think being wrong is ok as long as they feel good about themselves.
Parent
What the hell? (Score:1)
Since when does staff have unfettered access to user passwords? The absolute most that the help desk can do is reset the thing, not view it.
Seriously - they got bigger problems than being insulted via password if the friggin' help desk can call up passwords at will and whim.
Re:What the hell? (Score:4, Insightful)
Parent
Ok, and... (Score:5, Funny)
I read the article and it only reports half the story.
Sure he tells us all about his password and what he is using. But what was his account name?
I once had a funny incident with some website. (Score:5, Funny)
Him "Ok give us your information."
Me: I gave him my information.
Him"You want your password now?"
Me:"Yes please."
Him,"Biteme."
Me:"What?"
Him,"Biteme is your password."
Me,"Oh... Thanks..."
I made a mental note,"Do not make passwords that will embarrass me if I have to call in the phone"
I'm more disturbed by the fact... (Score:3, Interesting)
...that neither the submitter nor the editor (samzenpus) are able to spell the word 'Lloyds', despite it appearing a number of times in the original article.
Let's petition CmdrTaco to banish samzenpus to Idle, where his delusions of adequacy will better fit in.
Re:I'm more disturbed by the fact... (Score:5, Funny)
Let's petition CmdrTaco to banish samzenpus to Idle, where his delusions of adequacy will better fit in.
Let us start tagging idleispants.
Parent
plaintext passwords (Score:3, Informative)
Your complete credit card details including 3 digit security code on the back.
Your complete address, maiden name, old addresses etc etc.
They use all of this info to verify who you are before they tell you anything about your account, so you ring up and say "Can I see my balance", and they ask for random bits of the stored info.
You just have to hope that they aren't dodgy employees as they could quite easily steal it all if they wanted.
Re:plaintext passwords (Score:5, Insightful)
Or back it up into unencrypted ISO images on their hard drive then sell their laptop on ebay, which seems to be standard practice at UK banks, Inland Revenue and other organizations which deal with such personal information.
Parent
Re:plaintext passwords (Score:5, Interesting)
What hacks me off the most is that where I work (defence contractor) we have to have baseline encryption on our entire laptop drives and a second encrypted area for the more sensitive stuff. USB drives have to be encrypted as well, and PDA type (so ipod's phones etc) devices can't connect unless you are in the priviledged few who need to share data with external agencies or with our test systems.
(My personal laptop (the one I'm typing this on) I've got my own encrypted linux filesystem on, only the windows bit isn't encrypted and bar photoediting its not used much)
Why if we have to jump through various hoops or lose our supplier status can't the UK government departments and contractors working directly on their behalf do the same? (And ditto for banks.)
Everyone involved with handling personal data needs to look into data minimization and data protection (integrity, access control, non-repudation, auditing, the whole shooting match), and any company found not doing so should be banned from handling personal data ever again. Government departments are harder to control (after all the MPs won't vote in a law which would neuter the IRS ;) ) - so make the law such that the minister and the civil servant in charge of the affected department face a 1 month jail sentance for every 100 records lost, loss of pension rights, barred from being company directors etc...
Parent
Passwords are awful for security (Score:5, Interesting)
Everybody knows passwords. We're all used to them. But they suck rather miserably for real security. They are a vast improvement over nothing at all, but they just aren't good enough, anymore.
All it takes is one leak of your password, and you're hung. Worse, you don't know that you're hung. You can't let somebody else use your password. Ever. You can't ask a family member to enter it in for you while you're on the road while they look up your bank balance on the way to the airport without disclosing your password.
And lots of people can see your password. Techies. Poorly-paid tech support people in India. System administrators. Clerks, counters, janitors, and people who dig up your stuff out of the pile of computer hardware behind XYZ large firm.
Passwords are a terrible, terrible idea for security, and have left the social environment highly vulnerable to vast compromises.
On the other hand, dual-key cryptography is rather good for security.
It doesn't matter who sees the key exchange. If somebody else gets your public key, it doesn't weaken the strength of your private key. Nobody else can see your private key. You don't need to disclose your private key to anyone to use it.
Personally, I'd like to see a password-key machine. Basically, a weak form of dual-key cryptography (at least as effective as a password) stored in a small doohickey. It has your private key. Rather than type in a password, you are given a set of characters that you need to encrypt with your doohickey. You type the characters into your doohickey, and indicate which private key you want to use. (since it's private, you really only need one)
You enter in the passphrase for your private key. You enter the response back into your website, whatever.
Weaknesses? Not many.
1) You can lose your doohickey. At which point you need to get another one, regenerate a private key, and hand out new public keys to everybody. But even with the doohickey, $RandomBadGuy can't do much without the passphrase. Which is not a "password" in the usual sense because it's only stored there, in the doohickey and cannot be seen by anybody else.
2) You can use your doohickey thru the phone. Your son-in-law is checking your bank balance for you, and you want him to - this time. He sees the challenge, and tells it to you. You enter challenge into doohickey, give him the response, and he types it in. That gives him nothing more than a login that time, because next time, the challenge will be different, and without doohickey, he can't do anything more.
3) Nobody else sees your private key. It's yours. It's private. Websites and such will have your public key, but it won't help them any since they don't have the private key that matches.
Doohickey doesn't have to be much - it could easily fit into a cell phone. Processing a small, 32-bit key isn't difficult, and the challenges don't have to be very long to well exceed the security of your average password. (EG: Wife's middle name, the street you were born on, etc)
Parent
I know of someone who can help (Score:5, Interesting)
Mr. Yorkshire Bank Plc Are Fascist Bastards was able to get a judge to order Yorkshire Bank to issue him a cheque payable to his full name.
Important message to Lloyds customers (Score:5, Funny)
My Dearly Beloved Lloyds customers.
I encourage you all to change your passwords to Lloyds is pants in protest at this stupid bank's actions.
Thank you sincerely for your cooperation.
Mrs Mariam Abacha, Lagos, Nigeria
Ownership (Score:2, Interesting)
The customer does not own his password. As its purpose is to allow access to the services the company provides it is the property of the company. Of course changing it like that was a stupid and childish thing for an employee to do.
Password reminders (Score:1, Funny)
Heh, luckily I've never had problems. My password reminders (one which I use for my ISP, who use it to authenticate who I am), is usually something along the lines of...
Who the hell uses password reminders anyway, like come on, isn't there a better way?
So I need to say a line like this every time I talk to them, it often gets a bit of a laugh and provides the call with a little levity.
Six letters? Bollox. (Score:3, Interesting)
"The rules seemed to change, and they told me it had to be one word, so I tried 'censorship', but they didn't like that, and then said it had to be no more than six letters long."
I would have then asked for it to be changed to bollox and then proceeded with increasingly vulgar suggestions. Fanny would be a good choice.
Nope! (Score:2)
He should let them set his password to whatever they please . . . for as long as it takes him to clear his money out of there and into another bank.
New password (Score:3, Insightful)
fun with passwords (Score:5, Funny)
Until a few months ago, I did some helpdesk work at a web hosting provider. When a customer calls in, we are required to make them verify that they are the account holder by telling us either the last four digits of their credit card or their hosting account password (which they specify when they're signing up for service).
One day, a new customer calls in and says he's having some trouble setting up DNS and would like some advice. He's maybe in his late teens or early twenties He gives me the account number. I notice that he makes his payments via PayPal. When I see his password, I hit mute on the phone and giggle for a few seconds. After my composure is somewhat regained, I unmute and ask him to verify his account password for security purposes.
You could almost hear him tense up. When he starts stuttering, I was sure he never stopped to consider that he might have someone
"Ummm, uh, it's fuckyou2dickhead."
I helped him through his DNS questions as politely as possible and we got along pretty well. Before hanging up, he asked if there was a way he could change his password online. I said yes, through our monitoring and billing system.
He gave a huge sigh of relief.
SL did that to me (Score:4, Informative)
Linden did that to me with my Seconf Life account, after a crack of their server in 2006 IIRC. They told customers to answer a few questions about who their friends were etc to get their passwords back. I had been there only a few days and I didn't know how to spell my friends' names. Thanks to their crappy customer service I never could log back in. Luckily I didn't have a paid account. I was pretty angry at them, and rightly so I believe. It's very inconsiderate to change customer's passwords without their consent. They did it to protect their customers and I understand that, but I guess I was not the only one who was forced to make a new account.
What are they doing being able to read passwords? (Score:1, Interesting)
They have a total disregard for security by allowing the support staff to read the passwords.
The customer support people there have a horrific culture of ridiculing their customers. Nasty.
No changes for me, thanks. (Score:5, Insightful)
The change would be funny from a small company that you do some business with, but NOT FROM A BANK. Any sign of employee impropriety with sensitive information that your life savings depends on, is downright scary. And losing money might be the best outcome... A couple suspicious transactions is all it would take to raise a red-flag, and automatically trigger a police investigation for possible (drug/weapons/terrorist) money laundering.
I want nothing but monotonous, joyless, boring bastards handling all aspects of my bank account. In fact, computers would fit the bill perfectly.
For your benefit I hit delete. (Score:2)
The power of Ego!
This is a multi-billion dollar company. They, along with all the other banks, own Everything. --Correction; they lent the money needed to purchase Everything, and now are owed it all back with interest. God couldn't even pay that bill!
So, poor, poor Lloyds can't handle it when the slaves mutter amongst themselves? Geez! And that's it right there; the same petty fear of Everything (including the most harmless of school-yard slurs), drives their desire to control Everything. Pathetic.
-FL
BOFH? (Score:1)
That sounds a bit like this guy: BOFH [theregister.co.uk]
Lloyds, not "'Llyods" (Score:2)
Re:Lloyds, not "'Llyods" (Score:5, Informative)
The headline; "Changing Customers Password Without Consent" needs a possessive apostrophe ("Customer's") and in the text:
"a sense of humour rears it's ugly head" should NOT have an apostrophe.
Slashdot "editors"? Where can I get a job like that you can do blind drunk while playing video games?
Parent
Next time.. (Score:3, Funny)
..try "Lloyds ist toten hosen"
They probably won't change that one.
Plain text password necessary? (Score:4, Interesting)
My bank asks me the jth and kth letters of my password and never (and corresponds regularly to tell me so) asks for my complete password. Whilst this suggests they they do have the plain text stored on their system, could one devise a system that encrypted each letter of the password in some way that did not compromise the security of the stored hashes any more than the original hash?
Assuming a "strong" 8 letter password and two letters for verification it means that there is a 1 in 676 chance of a client guessing correctly in a single operator/client session. Not an unreasonable risk given the securiity that could be built into the session to avoid brute strength attacks.
I am having a bit of a think about it and I can think of a couple of techniques, but I am not sure that they are worthwhile. For example;
Just store the all the encrypted pairs (NC2) where N is password length, assuming 8 characters, only 28 combinations. Can these be stored without compromising the crackability of the whole password? I guess it would but by how much is a bit beyond my thumbnail calculating ability. Or;
Can we build a sufficiently strong transposition cypher so that we can compare specific letter positions encrypted without knowledge of the other letters?
My other bank uses SMS messages with one time codes to do verification. That seems to be very effective.
Silly (Score:1)
Quite the opposite in Canada (Score:2)
At TD Canada Trust, the have an excellent web interface, where you can customize many aspects.
For example, when I load my profile, my greeting message is "DON'T SAY PLEASE FUCKHEAD!" (a quote from Blue Velvet), my credit card account is called "Devil's Due", and my line of credit is called "Slush Funds".
Umm - it starts earlier than that.. (Score:4, Insightful)
The first question you should ask is how a rep can change a customer password without his permission and knowledge. All you need is one with criminal connections and he'd be able to start messing with accounts for a while. Do this for a month, hit a couple of big ones at the end and disappear.
If I were the customer I'd go after the bank re. diligence failure. I couldn't care less about the pettiness (as ex Lloyds customer I agree 100% with the sentiment expressed), but I would raise serious questions about the processes involved, from HR to account management.
If I were the customer I would now insist on choosing a new password (as the entire planet knows the old one) and I think something like "You are all complete morons" would be suitable:
"What is yous password, Sir?" :-)
"You are all complete morons"
"That is correct, Sir, thank you"
wrong tree (Score:3, Insightful)
"funny or not" isn't the right question to ask here.
The right question is: "Why was customer service able to access his plain text password?" - when every book about security tells you to store passwords hashed. They should never even know what his password actually is.
Wait a minute... (Score:2)
Bollox (Score:1)
Hey, it's six letters.
Profit (Score:2)
Damn, I must stop posting complete business plans.
Acceptable (Score:3, Insightful)
.
Two additional things are not acceptable:
For those not from the UK and curious (Score:1)
Why are people looking at passwords? (Score:2)
Isn't it strange/scary/odd that someone is looking at passwords?
On a similar note, every time I have to reboot a Windows box or have to enter a reason for a shut down/restart I enter "Microsoft sucks" or "F%$#k you Bill Gates" (without the censorship)
I think more people should do this. :-)
Human readable passwds??? (Score:2)
I would be extremely leery of any security system that allowed _anyone_ to read passwds unless for verbal authentication. Otherwise, they should be always be cryptohashes.
Whats not acceptable (Score:2)
is the fact that anyone in the company can see customer passwords in the first place. So much for security.
This did happen to me (Score:2)
breach of privacy policy (Score:2)
a password is a personal piece of information. a CSR's knowledge of your password is a violation of the terms of their privacy policy.
or the simple answer is, have them set it to something simple and change it manually via their web interface later.
If it were me... (Score:2)
At that point I would have chosen, "TOSSER"
Choose your security phrase carefully... (Score:1)
"Who am I talking to?"
with the answer " scum".
Yes, it's that level of mutual respect that will make helpdesk staff want to talk to you...
what isn't acceptable is (Score:3)
The combination is what kills. (Score:2)
This is a case of cumulative disaster, frankly. These guys have done a whole bunch of not-so-smart things that together combine into real stupidity -- they are advocating both password sharing and they are allowing a help desk person to INTERPRET a plaintext password. Not to mention instantiating password polices requiring a single dictionary word with a limit of 6 characters!
This means that punctuation probably doesn't count. Capitalization doesn't count. Spelling probably doesn't count. If an attacker can come up with a reasonably approximate phonetic representation of the password, then chances are, the help desk will assume the caller is the right person. After all -- if there was a requirement for an exact match, then the help desk person could just type in exactly what the user tells them and get a yes/no answer back without ever seeing the password, and the plaintext requirement wouldn't exist.
Once you have the password for account viewing, how much money do you want to bet that a significant proportion of customers use the SAME password for all their other activities with the bank? But don't worry -- that second, possibly identical password is protected with "full security procedures"...
Could be worse... (Score:2)
Back when I was doing tech support for Worldnet dialup internet, we could change people's passwords when requested (and we could also just read off what it's currently set to). I got a call once from someone saying they couldn't log in, and wanted me to read off their password. After the usual verifying security, I gave 'em their password... which was at the moment set to... umm... let's just say another way of saying "homosexual lover", since putting the actual password would likely set off the swear filter. Yeah, THAT was an awkward call.
The system logs the tech's login for any changes made to an account, so it was easy to see what happened. Someone, on their last day of work, changed some people's passwords to either racist, homosexual, or other various types of things.
Because of that incident, they stopped us from being able to either read passwords, or even create them to what someone wanted. If someone forgot a password, we could randomly generate a new one. That's it.
How was it noticed? (Score:1)
Beyond the fact that the password was changed, how did the rep see it? Was he going through all the accounts looking at the passwords and see this one?
Re:How did they even know his password to begin wi (Score:4, Informative)
From TFA:
A man who chose "Lloyds is pants" as his telephone banking password said he found it had been changed by a member of staff to "no it's not"
They can't store that clear text if they want to verify it.
Parent
Re:How did they even know his password to begin wi (Score:4, Insightful)
Parent
Re:How did they even know his password to begin wi (Score:2)
I apologize for the shortness of digital temper, I just quit smoking
I'm sorry to hear that your fingers are so testy. Maybe you could hold a pen between them?
Anywho, I'm thinking this is a voice challenge and response with the live telephone customer service agent. They'd pretty much have to have that in plaintext. Hopefully they also use a long PIN number that's stored as a hashed value.
Parent
Re:My Password (Score:5, Funny)
Parent
Re:My Password (Score:5, Funny)
"I hope my cookies never expire."
That should be on a Tee-Shirt.
-FL
Parent
Re:My Password (Score:2)
Damn, that's the password on my luggage!
Parent
No wonder it didn't work! (Score:1, Offtopic)
Parent
abscissa here (Score:3, Funny)
Who changed my password?
Parent
Re:Lloyd's (Score:3, Funny)
Parent
Re:Fail2o8s (Score:2)
Nice to see the editors have a chance to post AC style. Carry on. I'm sure this practice with grammar will improve the proofreading for the next article.
Parent
Re:least of their problems (Score:2, Informative)
Parent
Re:How did they even know his password to begin wi (Score:1)
Parent
Re:Uhm, secure? (Score:2)
If I told a Fortune 500 exec that I can't remind him what his password was for an account with my company, he'd think I was retarded. Typically, people with money would rather be reminded of what their password is in the 1 second it would take than have you reset it and send them some gibberish password they'll have to change (or send them somewhere else to reset their password). They have enough at risk to recognize security is more or less an illusion over apathy. Inconvenience, however, is not.
tl;dr: hashing passwords is popular on slashdot, not so much in real life.
Parent