6 ms·

Meet Time Warner Cable. Time Warner, which has an obscenity filter on their passwords. Enforced server-side! Bets on how long before those folks make the new

Meet Time Warner Cable. Time Warner, which has an obscenity filter on their passwords. Enforced server-side! Bets on how long before those folks make the news for losing a hundred million unhashed passwords?

frommstoms 10y ago
That is ridiculous. Why would you even filter passwords? It's not like it is public, unless you are planning on making it so.
- fps 10y ago
  My guess is that when you call them on the phone, they ask for your password to validate your identity. Which means it's stored in plain text in their database so that customer service can verify what you said is correct. Maybe they don't want their employees to have to be cursed at by customers. I can't think of a good way for a business that has an online interface and frequently handles phone calls from customers to validate that they're talking to the correct person. Asking for other personal information can be used by an attacker to compromise multiple accounts via social engineering: http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/
  - Bartweiss 10y ago
    Someone else in this thread mentioned a company that has customer service type in your password to open your account. So that would be a non-plaintext reason to insist on non-obscene passwords. But it's still terrible, because why the hell is customer service typing in your password. Pretty much all organizations that allow phone authentication seem to be at risk of engineering attacks. The only ones that manage it send you something verifiable they can ask about like a credit card, and people who really care like the government just send an actual human to your house.
    - WorldMaker 10y ago
      I'd prefer to have an obscenity in my password if a customer service representative is seeing it. That would help communicate my frustration with their system. Saves me from having to voice that same obscenity, most likely.
  - billmalarky 10y ago
    It doesn't have to be stored in plain text to validate it is correct. The phone operator could enter it into an authentication form to verify it is correct.
  - witty_username 10y ago
    Customer care clicks a button to create a random temporary token associated with that account and user has to log on and read that token.
billmalarky 10y ago
Devil's Advocate: They could filter for obscenities before hashing.
- Bartweiss 10y ago
  The concern isn't that there's no way to do it, it's that there's no reason to do it unless the plaintext is going to matter again in the future. The best guess I've seen is that they might be hashing, but also having people read passwords to customer service reps. That would justify caring about rude plaintext, but it's also a terrible system.
  - billmalarky 10y ago
    Heh, to be fair, we are talking about a company with millions of customers that is consistently rated as "most hated" by consumers. I'd be surprised if a decent percentage of attempted passwords weren't "fuck time warner"...
    - Bartweiss 10y ago
      Hah. I can see some poor support rep getting a dozen calls a day with insulting passwords, actually - maybe it's about reducing call center turnover...

frommstoms 10y ago

That is ridiculous. Why would you even filter passwords? It's not like it is public, unless you are planning on making it so.

fps 10y ago
My guess is that when you call them on the phone, they ask for your password to validate your identity. Which means it's stored in plain text in their database so that customer service can verify what you said is correct. Maybe they don't want their employees to have to be cursed at by customers. I can't think of a good way for a business that has an online interface and frequently handles phone calls from customers to validate that they're talking to the correct person. Asking for other personal information can be used by an attacker to compromise multiple accounts via social engineering: http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/
- Bartweiss 10y ago
  Someone else in this thread mentioned a company that has customer service type in your password to open your account. So that would be a non-plaintext reason to insist on non-obscene passwords. But it's still terrible, because why the hell is customer service typing in your password. Pretty much all organizations that allow phone authentication seem to be at risk of engineering attacks. The only ones that manage it send you something verifiable they can ask about like a credit card, and people who really care like the government just send an actual human to your house.
  - WorldMaker 10y ago
    I'd prefer to have an obscenity in my password if a customer service representative is seeing it. That would help communicate my frustration with their system. Saves me from having to voice that same obscenity, most likely.
- billmalarky 10y ago
  It doesn't have to be stored in plain text to validate it is correct. The phone operator could enter it into an authentication form to verify it is correct.
- witty_username 10y ago
  Customer care clicks a button to create a random temporary token associated with that account and user has to log on and read that token.

billmalarky 10y ago

Devil's Advocate: They could filter for obscenities before hashing.

Bartweiss 10y ago
The concern isn't that there's no way to do it, it's that there's no reason to do it unless the plaintext is going to matter again in the future. The best guess I've seen is that they might be hashing, but also having people read passwords to customer service reps. That would justify caring about rude plaintext, but it's also a terrible system.
- billmalarky 10y ago
  Heh, to be fair, we are talking about a company with millions of customers that is consistently rated as "most hated" by consumers. I'd be surprised if a decent percentage of attempted passwords weren't "fuck time warner"...
  - Bartweiss 10y ago
    Hah. I can see some poor support rep getting a dozen calls a day with insulting passwords, actually - maybe it's about reducing call center turnover...