10 ms·

> "We used a rep that literally done all the work for us" This is why the privacy and security guarantees of almost all companies, credit bureaus, banks, the I

• salemh 6y ago
  How does a single rep coordinate the mass amount of posts across verified (and non verified?) accounts? That is an insane amount of access for 'a rep'. They can just copy and paste the same message across that level of accounts?
  • kevingadd 6y ago
    The rep can perform a password reset and/or change the sms/email pair and then attackers can do the rest and make the posts themselves.
    • dboreham 6y ago
      One rep does password resets for scores of high value accounts?
      • Frost1x 6y ago
        There are probably other factors involved, like access to other information used for MFA and compromising those mediums or using information related to them to assume identity.
      • michaelt 6y ago
        Before this incident, protections against that were probably "a good idea at some point, but not near the top of the backlog right now"
• centimeter 6y ago
  If you have a system where customer service reps are strictly unable to access your data without some kind of cryptographic authentication, that defeats the purpose of customer service for 80% of customers (who suck at using computers and mostly just lose their passwords). If you’re in the other 20%, you might as well use some kind of decentralized cryptographic system with no customer service anyway. This is one of the chief complaints I see against Bitcoin on here - “what if I lose my password?” - the implicit dual to that being that someone else can access your account without your password, and you hope they’re not a bad actor.
  • dboreham 6y ago
    Yes but you can mitigate the risk by limiting the rate at which any rep can perform security-impacting operations such as password reset, and by denoting high value accounts as requiring additional manual approval.
• zug_zug 6y ago
  I'm fairly sure most banks operate this way. For example, I think they can't even see your account balance until they have entered phone #, mother's maiden name, etc.
  • gowld 6y ago
    So anyone who gets access to your Facebook profile can see all your bank data.
• alquemist 6y ago
  Great idea! User accounts are locked by default, and can only be accessed if unlocked, for a limited time period, by the user themselves. For extra security, though more friction, the unlock process generates a time limited access token, provided by the user to the rep, reducing the access surface to just the rep that possesses the token.
• stanmancan 6y ago
  I don’t know the details but whenever I call Hover for support, they have to email me a code that I have to read to them to unlock access to my account. If you have 2FA enabled you need to give them that code too. I’m not sure if they are just verifying but it sounds like they actually can’t do anything without the codes.
• dleslie 6y ago
  This is something I argue with coworkers et al to no end: differential privileges are targets for privilege escalation! From their perspective, they want the ability to ban/kick/etc as special powers; but from my perspective that feature is an exploitation target that's vulnerable to any unknown bugs, and probably in twitter's case, social exploitation. I would _much rather_ see all users be equally powerful and find some means by which the services can be designed such that everyone can be comfortable and safe.
• rapnie 6y ago
  > I'd like to see a system where it is physically impossible for a customer service rep to discover any info about me until I authenticate and authorize it. Isn't this the objective of Tim Berners-Lee Solid Project and their Personal Online Data storage (PODs) in the spec? https://solidproject.org https://solidproject.org
  • gowld 6y ago
    No. POD is about who you share with, not what happens after you share.
    • rapnie 6y ago
      Thought it was who you share what with, so including the auth/authz as parent asked. After sharing happened all bets are off.
• peledyu 6y ago
  We use OpsGenie at work. I've used their support a couple of times. Every time they needed to look at our company's account settings I've had to approve it (using some sort of OpsGenie internal tool). I was pleasantly surprised. It's impossible to tell as a customer how hard it is to access my data without that internal authorization system, but it at least looks better than nothing.
  • manquer 6y ago
    There is no guarantee though, i.e. the system could be well intentioned but if could be bypassed , it does not really protect. The only way to get some assurance is run vendor app in your environment in a secure network without the ability to phone home.
    • skrebbel 6y ago
      Obviously it can be bypassed in the sense that somebody has full administrator database access. The point about schemes like this is that instead of having to give 1000 support reps full access, you only give a few sysadmins full access. The likelihood of something going wrong with the data (through mistakes, willful abuse, extortion, whatever) goes drastically down. In fact, once you got such a permission system in place, it becomes very attractive for the organization to use it. I mean, customers love it, they spontaneously write comments about it on Hacker News. Even if you begin adopting it only for security theater (i.e. everybody still actually has full access), eventually some principled engineer brings up the idea to maybe remove full access for everybody cause now they have the access-granting system anyway, and this time they'll make a convincing case because the "move fast and break things" people have way fewer practical objections.
      • gowld 6y ago
        That's a very 90s view. The modern view is that only robots are sysadmins, and those robots are indirectly controlled. Some humans have superpowers in some systems, but not in the whole system.
• jedberg 6y ago
  Whenever I call into E*Trade, first they send me a text with a code. They can't see the code, they just get a box and have to enter in the code I give them and it tells them if they are right. Then after that I have to read off my 2FA code. In other words, they have to log in with the same 2FA that I do. So a random customer service rep couldn't access my account without my phone in their hand, even if they managed to clone my SIM to get past the text message check.
  • bikeshaving 6y ago
    I’m not sure habituating people to getting asked for 2FA codes is a good idea. Seems like it’s just going to make people more susceptible to social engineering attacks.
  • 6nf 6y ago
    > Then after that I have to read off my 2FA code. Whats the point of this step
    • mschuster91 6y ago
      Make sure that even with a hacked SIM a malicious CSR can't access your account without your knowledge.
      • ricardobeat 6y ago
        Also ensuring that a hacker can get the 2FA token directly from the owner by pretending to be customer service...
        • Blahah 6y ago
          Seriously who designed a system that habituates people to giving out 2fa codes over the phone?? That's explicitly a weakness of the 2fa system, nobody should ever read out or forward their 2fa code.
        • thomaslord 6y ago
• raxxorrax 6y ago
  This is also why you want to have people in IT that can defer judgement if someone posts, does or says something that you do not like. Criminal behavior is another matter of course. But you would need to educate people with access about the importance of impartial management of user data. Banks had a culture enforcing neutrality and most importantly discretion. That is not true for modern payment processors like paypal or mastercard though. You certainly don't want Twitter activists in such a role, regardless of political affiliation.
• madeofpalk 6y ago
  Each place is different, I guess. When I worked at Apple Retail, there was an internal iCloud dashboard you could log into and see _metadata_ about customer accounts. You couldn’t see anything juicy, for Find My iPhone/Friends it was just the name of people would could see your location, not locations themselves. Number of documents, not access to actual documents. But nothing was visible to you until you verified the customer through security questions, last four digits, etc.
• mattlondon 6y ago
  > Does anyone know of customer service panels at big companies or government departments where this is the case? I.e., it is literally impossible for a rep to browse random customer information even if they are willing to break the rules? Yes - no names for obvious reasons but where I work (trust me you've heard of them/probably use them and they are a huge tech company) it is very hard to get access to anything even slightly customer related. You need to go through multiple levels of review and approval (often your manager, their manager, and then directors/VPs) with genuine business justifications that actually looked at (no "asdf" here) to get access, and then it is usually only permitted for a window of months at most before it is auto-revoked. Then once you have access, every actual time you look at the data you need to provide justification (e.g. a ticket number that is actually checked to make sure it is open, not reused over and over, and not just 1234567890 etc and so on), and every single action you do with the data is tracked and audited so there is a complete 100% paper trail of who looked at what, when they did it, and why they were doing it, with traceability through to the tickets/bugs/etc for why there were even doing this in the first place. Abnormal things (e.g. systematic/repeated/etc) raises flags that do terrible things to your career. Each system/data source needs its own independent approval process. There is no "god mode". It is not uncommon for people to wait weeks for approvals to go through to access their own data to validate a bug fix etc. I think these safeguards are worthwhile - many would see them as a hindrance. At past places, I implemented a call-centre UI once. We made it so that the service rep would initially not see anything about the customer, so the "Please can you confirm 3rd letter of your memorable word" or whatever meant that the service rep literally had a text box to type that letter in which had to match before they could proceed - they didn't see the whole world on screen and wait to see if the user got it right. I am not sure how common this is - when I do this from the customer side these days often the answer is immediately acknowledged by the rep without any kind of delay or typing noises so I am guessing they have my entire record on their screen and are just waiting for me to say the right things before continuing the call :(
  • cperciva 6y ago
    This is very consistent with what I've seen of AWS. Engineers have had to jump through many hoops to look at my account even when I've reported a bug and ask them to look at my account.
• jasonv 6y ago
  I work in banking. You’d be amazed at how serious the information and enterprise architecture is around PII and confidential data.
  • deleted 6y ago
    [deleted]
• wil421 6y ago
  AT&T claims my security PIN will prevent agents and in store associates from accessing my account. The store rep said there’s no way for him to help me doing anything until we called a special hotline to give my PIN and approval. Doesn’t mean there isn’t a way around it for some reps with special access. If you don’t have a PIN someone can go and open up multiple new accounts separate from your primary account in your name with different addresses. AT&T won’t even bother to tell you.
  • joering2 6y ago
    Wrong! Pin is designed as legal shield against you - it was initially designed because children of parents, disgrunted employees and angry spouses would show up with a phone and wanted access or make changes on that phone account and mere possesion of said phone “authorize” them. Now the terms of service clearly state pin is extra layer to protect your data from oursiders, be it your child or spouse. Meanwhile employees have full or near full access. I know this because my sister is a store manager. They would daily print list of accounts overdue and prepare list for followuos - should would check everyone in computer, their history of payments even zip code where they live and make decision whether to bother them with phonecall now or push it for another day. The only access they dont have is your credit card info. They cant even see the last four, since its separate third party company responsible for payments.
• eezurr 6y ago
  This is why IMO Google has almost no customer service. Their weakest attack vector would be people. Imagine paying your infosec employees hundreds of thousands a year to protect your clients data. Next to them (in terms of data access) is your customer service team at $30,000 per head. Which team is easier to crack?
  • X6S1x6Okd1st 6y ago
    You don't think part of the reason they don't have customer service is that the # of people they'd have to employ is huge?
    • dbbk 6y ago
      They do have customer service, if you pay for their premium service Google One. They also have support agents for YouTube creators above a certain subscriber threshold.
      • dayjah 6y ago
        For reasons I cannot fully remember my voicemail broke many years ago. It goes something like: I’d switched to google voice for vm, where T-Mobile handled my line generally. Then google did something to google voice, some sort of discontinuation + merging with gmail and my vm broke. This occurred in tandem with me moving to a house with terrible cell reception and before wide spread WiFi calling support. The result was that many folks figured I’d had my number disconnected because calls which couldn’t connect to my phone would get the “disconnected number tone” when being directed to my voicemail box. Every month or two I’d fill in the google support text area explaining the problem. No response for ~4 years. Just this Feb, for whatever reason, I decided to call T-Mobile and report it. Problem was fixed by a higher up tech that described the problem as “very strange” and the “first time” he’d seen something like this. It took approx. an hour. Upon rumination I full accept that I took the “easy way out” by filling in the text box vs trying to talk to someone. End result is that google lost a gvoice customer and no one calls me anymore. meh
        • 6y ago
• no_wizard 6y ago
  Supposedly my credit card company works this way (Chase), though you have to opt in to it when you sign up for two factor authentication. Sprint has the same thing, where they can’t get to anything on my account without passing two measures. I can’t verify this 100% unfortunately but they are notable because of how rare it is
• Blahah 6y ago
  The problem is that customers don't remember basically anything. I don't know my telephone banking password for any bank. When I call, I get asked to tell them what my last transaction was, or my mother's maiden name and DOB (public info), or what town I last used my card. I've been wrong about the recent usage questions more often than I've been right, and they say "close enough". The technological measures have to account for human behaviour. Otherwise you just end up with almost everyone not being able to access almost everything almost all of the time. People are forgetful, irrational, stubborn and stupid. So are institutions. Put them together and you have a social engineering dream world (literally our current world).
  • rapnie 6y ago
    When I bought my house a couple years ago, I had to put my signature to make a big and urgent money transfer. The bank however didn't accept my signature for some reason, though I had been using it every time with them. It appeared that normally they not really check if it matches, but this time given the transfer amount they did. And it just so happened that the signature they had scanned in their system was the first one I ever made as a kid (30yrs ago) when I opened the account. Finally after many retries they turned the monitor to show me the expected signature and let me practice it on a piece of paper, so it would pass some other approval stage. With a 200 yard line waiting behind me, sweating profusely, I finally managed to reproduce something. The sale went through, luckily, and immediately after I ditched that bank account.
    • WrtCdEvrydy 6y ago
      > immediately after I ditched that bank account. Because they showed you the signature and let you practice, right?
      • rapnie 6y ago
        Yup, but also because they could have my evolved adult signature on file, or at least asked me after certain time interval to update it for their records.
    • 6y ago
• sneak 6y ago
  > Every customer service rep that works at any of those places -- all 500 or 5000 or 50,000 of them -- can pull up info on anyone at any time. The only thing that prevents that is rules. There are no technical countermeasures. Yup. Doubly so for sysadmins, many of which have abhorrent data security practices. My personal solution is to use cover names, disposable phone numbers, and unique email addresses (the + trick is insufficient) for most services. My assumption is that the data is eventually either going to leak, or be used to threaten or harm me in some way. If none of the PII overlaps with me, it becomes a lot harder for such an event to affect me. The only downside is that sometimes you get companies (Airbnb, Instacart, some others) that have CSRs that demand a government photo ID to do certain tasks. Of course I don’t have any documents for these cover names, so usually the workaround is to just abandon that account, make another, and re-place the order or transaction in a way that doesn’t flag it for manual review/intervention. Works pretty well for me most of the time.
  • novok 6y ago
    What are the form of the emails? text@singledomain.com, text@disposible.email.service.com ? What if the service requires constant SMS OTP that you cannot opt out of?
    • sneak 6y ago
      I use both forms, including AnonAddy for the latter. For services that insist on frequent SMS OTP I usually just replace them with a different service, or I use dtmf.io.
• ATsch 6y ago
  Such measures are theoretically mandated under GDPR if you have >50 employees. I'm not sure how that looks like in practice though.
• time0ut 6y ago
  I have worked on controls in this area for a few US health insurance companies. From what I have seen, it is common to have additional restrictions on accessing high profile individuals and specific groups data. There is also a ton of auditing around this stuff. It is more primitive than what you described, but things are heading in that direction. It is a somewhat harder problem space because many parties need access to a customer's records in that domain. Ultimately, the only reason things are even this far along in health insurance is the regulatory environment. It'd be nice to have stronger privacy laws that compel companies to build good controls.
  • coldcode 6y ago
    I worked for a healthcare claims processing company that at the time stored all the production database and server passwords in a text file accessible to half the company, all because the chief architect didn't want to remember passwords. Yet we were covered by HIPPA and "passed our audits". If people don't care to follow the law and can manipulate the audit, who is going to stop them?
• tpurves 6y ago
  This was a big problem in the early days of online banking (early ‘00s). A fair number bank fraud losses were due to rogue internal employees at call centers creating or changing then selling off online banking passwords. Ran into this when I was with a startup that launched bank to bank email money transfers in Canada around 2001. Banks cleaned up their security pretty quickly though, adding deyailed audit trails for one, and variety of other security controls around their own employee access (like double sign-offs). There is a general principle that banks have understood for as long as there have been banks... not all threat actors are outside threat actors.
  • russell_h 6y ago
    In this case I suspect that there is an audit trail. It will lead to a Twitter insider who was “working from home” and had remote access to the tool, but had already left the country. Banks just don’t give support reps remote access to accounts.
• Sodman 6y ago
  When I moved from the UK to the US, I left some money in my UK bank account for a bit... A few years later I called up customer service with "Hi can you please transfer all funds to this new account at another bank in another country, and close my UK account? I don't remember any passwords, don't have the 2fa fob you gave me, don't have the phone number you have on file and don't live at the address on file." They asked me when I opened the account, which branch it was at, and who my employer was, and that was all it took. The phone call was under an hour, most of which was spent on hold. All of the required "security" information could be figured out from my public LinkedIn. Scary stuff.
• snowwrestler 6y ago
  I'm really surprised that this is the top comment right now because even the most basic back of the envelope check shows that it is wrong. Think about your own life: how often do you lose money because an insider hacked your credit accounts and bank accounts? How often do you get pulled over and your car taken away because someone changed the title/tags in DMV records? How often is your identity stolen by an employee at the IRS? These bad things all happen to some people, of course, but the VAST majority of the time, they do not. It is obvious that there are effective countermeasures to prevent and mitigate insider threats. Insider threat is not a new concept, and there are well-proven tactics for addressing it.
  • grawprog 6y ago
    I agree with most of your post, but the parent comment is not wrong about customer service panels being accessible by employees. A friend of mine worked at a call center for a major us phone provider, the only thing stopping employees from accessing customer records is a point based penalty system for infractions. While my friend worked there, one employee was caught accessing customer records and was never fired or anything and continued to do shady things until quitting. It was discovered he'd worked at multiple call centers before and did the same thing. Around the same time, at a nearby call center, two employees were caught ordering multiple manager's laptops, which managers can use to access customer records from their home. These laptops were sent out to multiple addresses and never found.
• jiveturkey 6y ago
  there are countermeasures. any competent org (agree with you -- probably not the majority of them) have auditing, so accesses are logged. back in the 90s we had this at my university ... it's an age-old practice. you as user would never know it. i would bet that most of the places you are thinking about (banks, credit card, and so on) where you get on the phone with a rep, with a phone entry system ahead of the agent, the agent can only access that specific data during the call, the access is logged, and any other access (some other account) is flagged for review. by calling in you are granting access. most users simply don't care about privacy and extra hurdles are just asking for complaints. limiting access to specific accounts during live calls is a fair compromise and a tight control. xero (they suck, so this is not an endorsement) requires you to give the rep access explicitly, as an option, when requesting tech support. of course i have zero doubt that senior reps can get access anyway (which would be audited), so the explicit control is more about signalling comfort to you about their security measures. after google had the SRE stalker incident they implemented very tight access controls to user data. i walked into a verizon store the other day to buy a hotspot. the rep could not get access to any info whatsoever (even billing status) until i acknowledged a message on my phone. it's clear they only had access to my specific data (ie, they don't get to enter any phone number and get access) for that specific interaction.
• TheKarateKid 6y ago
  * > Every customer service rep that works at any of those places can pull up info on anyone at any time. * This is simply not true. For example with banks, high-profile accounts can't be accessed by regular tellers. If someone attempts to, it is logged and someone is notified that Teller X tried to access the account. Now that Twitter is being used for high-profile official communications, they need to re-design their employee control panels to limit, alert, and control what an employee can do with an account. The fact that important credentials on so many high-profile verified accounts could be changed without notifying employees or locking the affected accounts until the actions are verified is unacceptable.
  • mitchdoogle 6y ago
    It shouldn't just be "high profile" accounts. Every person is susceptible to abuse by insiders, so give the same protections to all.
• guyomes 6y ago
  > Does anyone know of customer service panels at big companies or government departments where this is the case? E-government services in Estonia have nice features, aimed at giving more control to the owner of the data [1]. Among other: "It allows the Citizen to query who has accessed his/her records. [...] In Estonia, this feature has led to some very public cases of government officials being caught accessing private data of Citizens - without any legitimate and authorized reason for such access." [1]: https://doi.org/10.1007/s12553-017-0195-1 https://doi.org/10.1007/s12553-017-0195-1
• babesh 6y ago
  The problem is that it is all too common for these tools to not be sufficiently prioritized in these organizations. They are usually slapped together without security or much else in mind. They are barely maintained. Security concerns as they surface are addressed by tacking on auditing and authorization instead of more secure architectures.