3 ms·

That information is internally available within Verizon, to its employees, to (presumably) verify ownership of an account when speaking to a customer. None of t

• cdubzzz 11y ago
  It's understandable that the information is there and accessible. But, again, it should never be communicated between employees, only between employee and account holder. Maybe such policy is not common practice for businesses? It seems like an obvious security measure.
  • Washuu 11y ago
    When I worked for Embarq doing DSL support the procedure for a field technician to obtain customer information was to call into a special phone number provide a technician code. There are several problems with this: 1.) The phone number can be found on the internet. 2.) The technician code is just noted down as part of the request. It is not verified. 3.) The support employee's validation process that they are a field technician was that they were calling over the special phone number. Obviously sensitive information was not supposed to be given out, but they hired anyone that was alive enough to answer a phone and tell people to reset their router.
• pbhjpbhj 11y ago
  >None of that is surprising - that information is commonly used as security challenge questions in phone support situations. // The PIN at least seems like it should have been hashed, then an employee puts in a form the stated PIN to see if it's correct and the hashes are compared on the backend. The other info though is needed for initiating contact and to allow customers to perform transactions (verifying card details for example).
  • aidenn0 11y ago
    That's definitely not how the PIN verification happens, as I got a single digit wrong once and the person on the phone told me that fact.
  • cortesoft 11y ago
    Hashing wouldn't help much for a PIN (which is usually just 4 digits). You could get a rainbow table for that in like 5 seconds. Even salting wouldn't help, given how tiny the keyspace is.
    • azinman2 11y ago
      The suggestion wasn't about having verizon's database being hacked, but rather that other employees can see this data at all.
• industriousthou 11y ago
  Well, it seems like employees should be able to verify that the security information matches what's on file without actually seeing. So, an employee could enter the last four digits of the CC number into a form and then get verification if they're correct, but wouldn't be able to just pull up that info and give it to someone else.