3 ms·

This is an excellent point. > "You forgot the password that you've logged in with multiple times... including 20 minutes ago." That should raise a flag.

• tamar 11y ago
  Namecheap has security notifications that inform you of login attempts. https://www.namecheap.com/support/knowledgebase/article.aspx/486/45/how-can-i-adjust-security-settings-for-my-account https://www.namecheap.com/support/knowledgebase/article.aspx...
  • pyre 11y ago
    This is more about preventing the social engineering attacks. The example you're replying to is where the actual user logged in 20 minutes ago, while the attacker is trying to claim to customer service that they forgot the password. If customer service were looking at login attempts, they would see that it doesn't make sense for the user to not know their password, when clearly they provided it to the site just 20 minutes ago.
    • tamar 11y ago
      I'm aware. This is an isolated comment about other security mechanisms that are in place for the user (not for the support staff).
  • judemelancon 11y ago
    One of the most frustrating things for support or customer service personnel to do is respond to something other than what was said.
• ejcx 11y ago
  It actually should not. People using a password manager might not ever know their password. Funny things happen with password managers where history is missing, changes don't save, keystrokes break things. We can't penalize users who use them. It's unfortunately a really messy area. Source: was a password manager in a past life
  • blowski 11y ago
    That's why it should only raise a flag rather than totally stop. Perhaps the customer service rep can ask a few more questions. It's a similar situation to someone who only ever uses their credit card to buy small amounts from their local supermarket. Then suddenly they use it to buy a flight in another country. It might be legit, but it's often not, and should suggest that customer service need to do more investigation before approving.