3 ms·

I asked a Rackspace rep about this. Here is the real deal: - passwords are NOT stored in cleartext - however, passwords are visible to customer service via a

I asked a Rackspace rep about this. Here is the real deal: - passwords are NOT stored in cleartext - however, passwords are visible to customer service via a "secure, non-public tool" - the reason for this is because "people generally prefer to give out a password to authenticate themselves [over the phone] than portions of the billing information" - so if a user account database is stolen somehow, the malicious thief would not have access to convenient info like email/username/cleartext password. (However if a customer service rep is the bad guy, you're still in trouble since they have access to the tool.) - at some point, Rackspace intends to "removing CSR access for SAS-70 purposes and moving to something like a challenge/response like the Managed division uses." AFAIK SAS-70 is some kind of audit regulation, but the wikipedia article put me to sleep after reading the first sentence.

nfnaaron 17y ago
"- however, passwords are visible to customer service via a "secure, non-public tool"" "- so if a user account database is stolen somehow, the malicious thief would not have access to convenient info like email/username/cleartext password." What if the secure, non-public tool is also stolen?
- wizard_2 17y ago
  The tool is probably for decrypting the passwords. The Passwords are probably hashed for verification to their website, etc, and then encrypted to a key which is encrypted to each tech's password as they hire new techs. I'm sorry, I should say, this is how I imagine a good way to do it would be, not that it's how they do it. This way though everything could be stolen and it wouldn't give up clear text passwords.
- sebastianavina 17y ago
  what if the rackspace employe sells password to hackers?
viraptor 17y ago
If they really don't want to verify hashes, is it really that hard to do a secure, partial information authentication system? - set a separate password for over-the-phone stuff - N specified letters from the password are requested by the customer service (3 <= N << len(password)) - customer service puts them into the system and gets a yes/no response I don't reveal the root password to the person, they get good enough proof that I know the over-the-phone secret. Alternatively, set a separate phone password and just verify it against the hash. I don't see any excuse for anyone to know my root password in full.
- Silhouette 17y ago
  > set a separate password for over-the-phone stuff Sorry, but I think this is the phone equivalent of insisting that you set a password using uppercase, lowercase, digits, symbols, at least 20 characters long and changing every 3 days. People are just going to start using obvious things or writing them down. True story: A few months ago, I took out a new credit card. During the application process, including activating phone and Internet access, I was asked for something like sixteen different pieces of personal/security information. The first time I wanted to call them a few days later to check something was now ready, I was asked for my "pass code". I had no idea which of those pieces of information that was, so Call Centre Guy says not to worry, he can verify me via other details. He runs through a series of questions, at least one of which makes no sense in the circumstances (in fact, that was the reason I was calling). At the end, he says he's sorry but I've failed security and he has to hang up now. All he can say is that I haven't provided the required answer to all of the questions. I tried to go on-line, and was asked to enter some memorable information. Apparently, I gave them three different things during sign-up and any one of them would do. No doubt I chose someone's birthday, etc., but of course I had no idea who and there was no kind of prompt. So I couldn't get in over the Internet either. Finally, I gave up and went back into the branch, where the staff had been helpful and efficient while I was setting things up to start with. They called through to a special number... which transferred to the same call centre and resulted in the same series of security questions, even though I was sitting in a secure area of one of their branches, with an employee who had already authenticated themselves, and who had seen my passport and driving licence two minutes earlier (which means they had access to two photos, two signatures, and my current address as a minimum). I gave exactly the same answers I had given to the previous guy, explained in exactly the same way why one question didn't make sense, and was told that was fine and how could he help? When I call my other credit card company, they ask for my six-digit DoB and typically my current credit limit to verify before doing anything significant. My business account needs a single password for everything, and for extra security provides a device where you push a button to generate a six-digit code that changes every few seconds. Two of these have the right approach. The one that uses separate security information for everything and all kinds of different types of validation is not one of them.

nfnaaron 17y ago

"- however, passwords are visible to customer service via a "secure, non-public tool"" "- so if a user account database is stolen somehow, the malicious thief would not have access to convenient info like email/username/cleartext password." What if the secure, non-public tool is also stolen?

wizard_2 17y ago
The tool is probably for decrypting the passwords. The Passwords are probably hashed for verification to their website, etc, and then encrypted to a key which is encrypted to each tech's password as they hire new techs. I'm sorry, I should say, this is how I imagine a good way to do it would be, not that it's how they do it. This way though everything could be stolen and it wouldn't give up clear text passwords.
sebastianavina 17y ago
what if the rackspace employe sells password to hackers?

viraptor 17y ago

If they really don't want to verify hashes, is it really that hard to do a secure, partial information authentication system? - set a separate password for over-the-phone stuff - N specified letters from the password are requested by the customer service (3 <= N << len(password)) - customer service puts them into the system and gets a yes/no response I don't reveal the root password to the person, they get good enough proof that I know the over-the-phone secret. Alternatively, set a separate phone password and just verify it against the hash. I don't see any excuse for anyone to know my root password in full.

Silhouette 17y ago
> set a separate password for over-the-phone stuff Sorry, but I think this is the phone equivalent of insisting that you set a password using uppercase, lowercase, digits, symbols, at least 20 characters long and changing every 3 days. People are just going to start using obvious things or writing them down. True story: A few months ago, I took out a new credit card. During the application process, including activating phone and Internet access, I was asked for something like sixteen different pieces of personal/security information. The first time I wanted to call them a few days later to check something was now ready, I was asked for my "pass code". I had no idea which of those pieces of information that was, so Call Centre Guy says not to worry, he can verify me via other details. He runs through a series of questions, at least one of which makes no sense in the circumstances (in fact, that was the reason I was calling). At the end, he says he's sorry but I've failed security and he has to hang up now. All he can say is that I haven't provided the required answer to all of the questions. I tried to go on-line, and was asked to enter some memorable information. Apparently, I gave them three different things during sign-up and any one of them would do. No doubt I chose someone's birthday, etc., but of course I had no idea who and there was no kind of prompt. So I couldn't get in over the Internet either. Finally, I gave up and went back into the branch, where the staff had been helpful and efficient while I was setting things up to start with. They called through to a special number... which transferred to the same call centre and resulted in the same series of security questions, even though I was sitting in a secure area of one of their branches, with an employee who had already authenticated themselves, and who had seen my passport and driving licence two minutes earlier (which means they had access to two photos, two signatures, and my current address as a minimum). I gave exactly the same answers I had given to the previous guy, explained in exactly the same way why one question didn't make sense, and was told that was fine and how could he help? When I call my other credit card company, they ask for my six-digit DoB and typically my current credit limit to verify before doing anything significant. My business account needs a single password for everything, and for extra security provides a device where you push a button to generate a six-digit code that changes every few seconds. Two of these have the right approach. The one that uses separate security information for everything and all kinds of different types of validation is not one of them.