3 ms·

That's really nice. I wish that more organisations responded in that kind of way; I certainly know that if someone wrote to us to complain about password or oth

That's really nice. I wish that more organisations responded in that kind of way; I certainly know that if someone wrote to us to complain about password or other security issues we'd certainly take it on board. What are the reasons that such inquiries often get stonewalled - is it simple organisational complexity, and the difficulty of actually contacting the right individual?

pveierland 10y ago
Their response to the entropy issue (which was a clear bug) was "we confirm that today's implementation yields a somewhat incorrect error message when using some special characters in passwords and that this will be fixed". When there is a clear bug it is fairly easy internally for them, since they just need to confirm the issue and send it to the right people to get it fixed. With the copy-pasting issue, their reply simply stated that disallowing this feature was intentional policy on their part and that their passwords should not be stored in any way. Changing policy and implementation would require a greater effort on their part, and admittance that a suggested change would improve their service. I then wrote a longer reply, arguing that following their password recommendation for the ~150 online accounts I had at the time would be infeasible without a password manager, and insisted that I would like a reply which did not refer to existing policy. The response to this was that it would be taken to their product manager. If the person handling the issue didn't care about the company doing the right thing or their job, or if they were convinced that their policy was correct, or if they believed escalating would certainly not lead to change in policy, the issue may not have been escalated. So the people handling issues must care enough to escalate unresolved issues, or the company policy must force escalation of unresolved issues, and at some point in the chain of escalation some person must believe that following the suggestion would result in an improvement.

pveierland 10y ago

Their response to the entropy issue (which was a clear bug) was "we confirm that today's implementation yields a somewhat incorrect error message when using some special characters in passwords and that this will be fixed". When there is a clear bug it is fairly easy internally for them, since they just need to confirm the issue and send it to the right people to get it fixed. With the copy-pasting issue, their reply simply stated that disallowing this feature was intentional policy on their part and that their passwords should not be stored in any way. Changing policy and implementation would require a greater effort on their part, and admittance that a suggested change would improve their service. I then wrote a longer reply, arguing that following their password recommendation for the ~150 online accounts I had at the time would be infeasible without a password manager, and insisted that I would like a reply which did not refer to existing policy. The response to this was that it would be taken to their product manager. If the person handling the issue didn't care about the company doing the right thing or their job, or if they were convinced that their policy was correct, or if they believed escalating would certainly not lead to change in policy, the issue may not have been escalated. So the people handling issues must care enough to escalate unresolved issues, or the company policy must force escalation of unresolved issues, and at some point in the chain of escalation some person must believe that following the suggestion would result in an improvement.