6 ms·

1and1 ask for passwords over the phone

129 points by timrogers 14y ago

timrogers 14y ago
In this situation, I don't think emailing their complaints department is going to help - I need the force of HN!
unam 14y ago
I had the same experience over the weekend. Wanted to use google apps for one my domains. They wanted me to email .html file which google gives you to a hotmail (really?) address and then give them the password as well to my 1and1 account. #fail
- timrogers 14y ago
  Completely ridiculous. How do they get away with this kind of stuff? I genuinely think the only way to put a stop to it is for an article like to get popular so they're forced to think.
  - unam 14y ago
    I asked the rep if I could give any other form of identification, guess what - your email address on the 1and1 account would do. I tried sending them the html file from the same email as the one on my 1and1 account and they did what I requested. This boils down to - they really don't need your password.
- brechin 14y ago
  If you host the domain there, shouldn't you already have access to put the file in the right place on your own (i.e. without help from CS/TS)?
  - timrogers 14y ago
    I guess it depends. If you have some kind of odd hosting package (for instance, if you [perhaps misguidedly] used a 1and1 e-Shop), you might not have file system access.
- carstendv 14y ago
  When you can manage DNS with them you can verify your Google Apps domain with TXT records. Oh wait, they don't allow you to configure TXT records either.
JSadowski 14y ago
1and1 is horrible anyhow, leave, fast!
brechin 14y ago
Perhaps it's time to consider another host? I've been happy with Dreamhost as a bargain-priced hosting provider.
saurik 14y ago
> Help me HN. Has anyone else had experiences like this with 1and1? What did they do to get things resolved? I use 1&1, and I ran into the same situation a couple months ago: I was terminating one of my contracts, and they asked for my password over the phone to verify. To be clear: I was not closing my account, I was only terminating a single contract. The way I "resolved" the matter was quite simple: as I am not stubborn, I just gave them my password. The person sitting on the other end of the phone call already certainly has godlike access to my account anyway, I am not stupid enough to use the same password for multiple accounts, and barring insanely epic hacks I know they are a real representative as I called them at their phone number; so, there is really very little to lose handing over my password to the customer support person. In the end, rather than getting morally outraged and posting an article asking a question to an online community in the hope of unblocking your ability to conduct what is fairly simple business, you should just change your password when you are done with the call and move on with your life. It will save yourself a bunch of time and frustration. Then, afterwards, if you don't like the way 1&1 operates (maybe you believe that this is indicative of a more underlying set of security mistakes, or maybe you simply don't agree with the practice and don't want to support it), you might then consider moving your accounts to a different provider: there are tons of people you can use to host servers, domains, or whatever else you may be using 1&1 for. However, it shouldn't block your ability to make things happen right now.
- timrogers 14y ago
  I completely understand your point, but I'd like to see things change rather than just abiding by this ridiculously bad practice. As you say, the rep obviously has full access without this so the whole act is pointless. Even if not for me alone, I'd like to see this resolve as it's just bad form. A company culture that allows this cannot be good for the security of all domains held with 1and1. I may well move away anyway, as you say, as I'm just so disappointed, but I'd like to see change anyway.
  - r00fus 14y ago
    You change the policies by applying economic pressure and moving your accounts to other providers. Seriously it's not worth your time to change other people's behavior. Better to give them incentives or (as in this case) take them away to sway their actions.
Rudism 14y ago
I've avoided using 1and1, but I recently made the switch from GoDaddy to Hover.com for my domains and it was like an amazing breath of fresh air followed by a clear mountain spring water chaser. Seriously. There are way better providers out there.
- timrogers 14y ago
  I probably will do, I just want to make sure that people know about this bad practice, and hopefully encourage 1and1 to sort this out.
stripe 14y ago
1and1 is a hosting company for the uneducated masses. Those do not care about telling some 1and1 employee their passwords because they think it is safe to do so. 1and1 is a great hosting company for someone who just needs a website. Nothing more. No Dns handling, passwords over the phone. Great advice has already been given: Leave them and make sure your account is terminated. And I mean really terminated.
wkonkel 14y ago
Give Badger a try... we salt and hash passwords. http://badger.com/ http://badger.com/
- ceejayoz 14y ago
  That doesn't (technologically) stop you from asking for a password to verify, though.
  - dromidas 14y ago
    I'm sure 1&1 actually does encrypt the password, otherwise the tech support guy probably would have just opened up tim_rogers.txt and found his password there. This sounds like 1&1 just doesn't have a real customer support story and should probably just be avoided if possible. Or find somewhere that lets you provide 2 part security (ie, one for personal access and another for support access). Author of the post said they should have some backend, and maybe they do, but I think the biggest problem was that they wanted him to authenticate himself as genuine with them by providing his password... they should have some other way to verify his identity without that. (This is my personal opinion as a security professional and not the opinion of my employer)
    - timrogers 14y ago
      I agree with your first point, or at least I'd imagine so. I've heard it suggested though that they don't so who knows! To me, it seems like they just have a badly thought out verification process when they should be doing something else - for instance, they could just the last four digits of your payment card or some other piece of relatively secret information. You have indeed crystallised what my issue is in this situation there!
- timrogers 14y ago
  Unfortunately though, you don't support .uk :(
aeden 14y ago
If you can get your transfer codes from them without having to give your password over the phone then start transferring now. You lose none of your registration period and you can find other registrars that don't suck. Even if you find a way to get what you want done with 1&1 you probably don't want to be doing business with a company that can't follow the most basic of security best practices.
- timrogers 14y ago
  I probably will!
tptacek 14y ago
Perhaps I'm misunderstanding the nature of this complaint, but it sounds like this guy is dealing with a service at which: * Tier 1 customer service people do not have plaintext access to customer passwords, and * Tier 1 customer service people do not have the ability to manipulate customer accounts without their passwords (and thus consent). On the scale of security/customer-service interactions at service providers, this sounds like MONUMENTAL EPIC WIN. What exactly am I missing here? And, How on earth could you possibly input a password into some random text field in an application that you would not provide to the CEO of the company hosting that text field?
- timrogers 14y ago
  I'm not convinced that the Tier 1 customer support reps do lack access without the password. It just seems to me like a misguided attempt at verifying identity. As for your second point, all that is based on trust in the company that they're not storing in plain text and opening it to the CEO...which I hope is the case for most companies. I was more trying to give a sense that I'm really not happy giving my password to any person. When it's a web form, you just have to have trust or the whole idea of passwords is broken.
  - tptacek 14y ago
    In case you missed it, the subtext of my comment is that neither of those bulleted items are true for most service providers. At most large service providers, you can count on tier 1 CSA's having direct plaintext access to your password and those CSA's being a mouse click away from taking any action on your account you can conceive of. Your first point is just innuendo, right?
    - timrogers 14y ago
      I'm not sure I understand what the point you're trying to make is. In a hypothetical (but unlikely) world where they <really> did need my password to manage my account, this would be a poor practice to have and it should have some kind of other verification, even if it was character [x] and [y] of my password. The same applies if they don't need it really...this doesn't seem a good idea regardless.
alternize 14y ago
while I agree 1&1 shouldn't ask for passwords... why not just temporarily change your password to something stupid, call support, and then change your password again?
- timrogers 14y ago
  I could (and may well) do that, but my issue is more one of principle. I could do this, but it shouldn't be necessary.
- adrr 14y ago
  Because its easier to complain about it.
timrogers 14y ago
What registrars are good who support *.uk domains? I've had good experiences with Gandi previously.
- ollysb 14y ago
  +1 for Gandi, I've only heard good things about them. I've been with fasthosts.co.uk for 10 years now(with zerigo for as long as I can remember as well), I've currently got 20 domains registered with them and I can't remember having had any problems with them.
  - timrogers 14y ago
    I do like Gandi, they're quite pricey though. Shall have to compare prices across the board! Zerigo seem good though.
- gmac 14y ago
  I use Gandi and domainmonster.com. No problems with either.
- drucken 14y ago
  For personal/small setups, UKReg.com Domainmonster.com 123-reg.co.uk All have solid reputations with 123-reg being the elephant in the industry but UKReg and Domainmonster having superb responsiveness and customer support.
degenerate 14y ago
Thanks for reminding me I have an expiring domain to transfer away from them!
IndianGuy79 14y ago
I have been long time user of 1and1 for domains. Their initial product offering is always sweet (free, 1$ domains) etc. Their renew rates are not bad as well. But the place where I hated them most was NS change propogation, it took 24 hours to get that done. Also their admin panel is awfully slow. If you guys don't already know it, here are some of the links to help To transfer/cancel domains you must go through : http://cancel.1and1.com http://cancel.1and1.com Admin: http://admin.1and1.com http://admin.1and1.com
- pjl 14y ago
  1and1's Control Panel is quite painful to use, but you don't have to go through cancel.1and1.com to transfer a domain - just make sure your domain is unlocked and you have the EPP code handy.
manaskarekar 14y ago
FYI: So does Citicards.
axusgrad 14y ago
Change the password to 1and1sucks, call back, and give them that. Oh wait, now everyone knows your new password.
suresk 14y ago
This doesn't sound good, but it got me thinking.. How do you verify someone is who they say they are in situations like this? As we've seen with recent breaches, the last 4 digits of your CC # aren't incredibly hard to find out. "Secret" questions and answers are generally quite poor, in that very few of them don't suffer from laughably small keyspaces or rely on semi-public information. Passwords almost seem like the least bad option. I get that giving a password to a human isn't a very comfortable feeling, but if you don't trust the CSR to not misuse the password, do you also not trust the developers to not have put in something to grab your password one of the various times you enter it into a web application that they control?
- tzs 14y ago
  Assuming that all you need to verify is that the person on the phone knows that account name and password, one way that would not be too difficult to implement would be to have a way for support to mark the account with a random 8 digit number. The support person does this, and then tells the customer to log in to their account management page. There should be a link there that shows the random 8 digit number. The customer then reads this to the support person over the phone.
  - suresk 14y ago
    Something like that would certainly work - I was thinking a one-time code could be emailed to the email address on the account, but either way would be fine. Given the relative simplicity, I wonder why nobody (at least that I know of) has implemented something like this?
    - saurik 14y ago
      This is how PayPal support works: you use the website to get a random six-digit "customer support PIN" which you then dial in when you connect to their system.
      - nthj 14y ago
        Media Temple operates this way, as well. I like this approach, as I can never remember those "4-digit account pins" (looking at you, AT&T), and I'm happier knowing any given pin is only usable for the next hour, anyway.
fosap 14y ago
I don't get it. At all. The only purpose of the password is to authenticate you against your account. Why would you refuse to use it for this? It's the point of a password that you submit it.¹ Oh yeah. Because you don't trust the guy on the telephone. He could easily hijack you account and do nasty stuff. 1) He could do if he wanted if you didn't tell him 2) You're not trusting him/her? Why are you doing any business with a company you don't trust? Or is the point that somebody could wiretap you? Get off your tin foil hat and think about keyloggers. ¹) Or do a challenge response. It does not matter. It's a shared secret.
- timrogers 14y ago
  The point is simply that established practice is to never share passwords, and this eschews that practice. I can see your point, but they have a variety of other data they could use to verify who you are. This is about the worst idea.
  - deleted 14y ago
    [deleted]
  - nowarninglabel 14y ago
    Actually, no it's way above better than other ways they could verify your identity. Did you not read account of the Wired reporter who had his online identity stolen and wiped because companies used easily obtainable information about the person to identify the person's identity? If they had used a password instead it never would have happened. I don't understand what your issue is with telling them the password? Just change it to something random and change it back after if it's not something you are comfortable sharing or saying out loud. It may personally offend you, but t's certainly not a bad practice.
  - fosap 14y ago
    No, that's not true at all. Every time you log in you share your password. That's the point of a password. (unless it's some fancy public/private key stuff).
jiggy2011 14y ago
To be honest, I've asked customers for passwords over the phone before. Usually it's because they have called reporting a problem with their email, now about 70% of the time it's because of a problem at their end but I have to humour them anyway. Now I can of course access their mailbox by going into a shell on the server but the quickest way to check everything and satisfy the customer is to setup their email account on my computer and check I can get it to work. Since the passwords are securely hashed, the only way I can do this is by asking for the password from the customer.
- rhizome 14y ago
  I see that as a failure of process. Your tools should already be constructed in a way that using them is easier and more reliable than asking for a password. Coupled with auth logging on the server side to diagnose failures on their side, there really should be no reason to ask for a password for this stuff.
crisnoble 14y ago
Personally I think it is hilarious to say things like "ampersand" or the "little carrot arrow thing err.. you know shift six" over the phone. I once had to leave my password in a voice-mail to my nurse, she told me "most people just make it something simple like their doctors name you know." I refrained from launching into a tirade about the importance of strong unique passwords.
stretchwithme 14y ago
I recall when I first heard of this outfit. I think it was 10 years ago. They wanted you to fax forms over to them. Perhaps early man got his domains that way.
- eli 14y ago
  My recollection is that in the bad old days of Network Solutions, you have to fax in domain registration and change forms. I seem to recall someone stealing a big brand's domain name for fun simply by faxing in some instructions on bogus letterhead.
circa 14y ago
I hate 1and1. I had to deal with their awful Website interface for a client of mine recently. I had to transfer over 100 GB of stuff on this guys "unlimited" storage account. they capped the speeds around 500KB/s. it seriously took all week. uploading to amazon and rackspace cdn's were a godsend after that.
- VMG 14y ago
  As a long customer in Germany, I can only agree. They have a lot of shady practices and I wouldn't recommend them to anyone.
dave1010uk 14y ago
I had this with Virgin Media (UK ISP). I called them and the support guy asked for my secret password. I assumed it was a security answer so I went through a couple of obvious ones like mother's maiden name. After a few attempts, he stopped me and said my password was strange because it was just a bunch or random characters. At this point I realised that not only was he expecting my actual account password for verification but it was available in plain text for him to manually verify!

129 points by timrogers 14y ago

In this situation, I don't think emailing their complaints department is going to help - I need the force of HN!

unam 14y ago

I had the same experience over the weekend. Wanted to use google apps for one my domains. They wanted me to email .html file which google gives you to a hotmail (really?) address and then give them the password as well to my 1and1 account. #fail

timrogers 14y ago
Completely ridiculous. How do they get away with this kind of stuff? I genuinely think the only way to put a stop to it is for an article like to get popular so they're forced to think.
- unam 14y ago
  I asked the rep if I could give any other form of identification, guess what - your email address on the 1and1 account would do. I tried sending them the html file from the same email as the one on my 1and1 account and they did what I requested. This boils down to - they really don't need your password.
brechin 14y ago
If you host the domain there, shouldn't you already have access to put the file in the right place on your own (i.e. without help from CS/TS)?
- timrogers 14y ago
  I guess it depends. If you have some kind of odd hosting package (for instance, if you [perhaps misguidedly] used a 1and1 e-Shop), you might not have file system access.
carstendv 14y ago
When you can manage DNS with them you can verify your Google Apps domain with TXT records. Oh wait, they don't allow you to configure TXT records either.

JSadowski 14y ago

1and1 is horrible anyhow, leave, fast!

brechin 14y ago

Perhaps it's time to consider another host? I've been happy with Dreamhost as a bargain-priced hosting provider.

saurik 14y ago

> Help me HN. Has anyone else had experiences like this with 1and1? What did they do to get things resolved? I use 1&1, and I ran into the same situation a couple months ago: I was terminating one of my contracts, and they asked for my password over the phone to verify. To be clear: I was not closing my account, I was only terminating a single contract. The way I "resolved" the matter was quite simple: as I am not stubborn, I just gave them my password. The person sitting on the other end of the phone call already certainly has godlike access to my account anyway, I am not stupid enough to use the same password for multiple accounts, and barring insanely epic hacks I know they are a real representative as I called them at their phone number; so, there is really very little to lose handing over my password to the customer support person. In the end, rather than getting morally outraged and posting an article asking a question to an online community in the hope of unblocking your ability to conduct what is fairly simple business, you should just change your password when you are done with the call and move on with your life. It will save yourself a bunch of time and frustration. Then, afterwards, if you don't like the way 1&1 operates (maybe you believe that this is indicative of a more underlying set of security mistakes, or maybe you simply don't agree with the practice and don't want to support it), you might then consider moving your accounts to a different provider: there are tons of people you can use to host servers, domains, or whatever else you may be using 1&1 for. However, it shouldn't block your ability to make things happen right now.

timrogers 14y ago
I completely understand your point, but I'd like to see things change rather than just abiding by this ridiculously bad practice. As you say, the rep obviously has full access without this so the whole act is pointless. Even if not for me alone, I'd like to see this resolve as it's just bad form. A company culture that allows this cannot be good for the security of all domains held with 1and1. I may well move away anyway, as you say, as I'm just so disappointed, but I'd like to see change anyway.
- r00fus 14y ago
  You change the policies by applying economic pressure and moving your accounts to other providers. Seriously it's not worth your time to change other people's behavior. Better to give them incentives or (as in this case) take them away to sway their actions.

Rudism 14y ago

I've avoided using 1and1, but I recently made the switch from GoDaddy to Hover.com for my domains and it was like an amazing breath of fresh air followed by a clear mountain spring water chaser. Seriously. There are way better providers out there.

timrogers 14y ago
I probably will do, I just want to make sure that people know about this bad practice, and hopefully encourage 1and1 to sort this out.

stripe 14y ago

1and1 is a hosting company for the uneducated masses. Those do not care about telling some 1and1 employee their passwords because they think it is safe to do so. 1and1 is a great hosting company for someone who just needs a website. Nothing more. No Dns handling, passwords over the phone. Great advice has already been given: Leave them and make sure your account is terminated. And I mean really terminated.

wkonkel 14y ago

Give Badger a try... we salt and hash passwords. http://badger.com/ http://badger.com/

ceejayoz 14y ago
That doesn't (technologically) stop you from asking for a password to verify, though.
- dromidas 14y ago
  I'm sure 1&1 actually does encrypt the password, otherwise the tech support guy probably would have just opened up tim_rogers.txt and found his password there. This sounds like 1&1 just doesn't have a real customer support story and should probably just be avoided if possible. Or find somewhere that lets you provide 2 part security (ie, one for personal access and another for support access). Author of the post said they should have some backend, and maybe they do, but I think the biggest problem was that they wanted him to authenticate himself as genuine with them by providing his password... they should have some other way to verify his identity without that. (This is my personal opinion as a security professional and not the opinion of my employer)
  - timrogers 14y ago
    I agree with your first point, or at least I'd imagine so. I've heard it suggested though that they don't so who knows! To me, it seems like they just have a badly thought out verification process when they should be doing something else - for instance, they could just the last four digits of your payment card or some other piece of relatively secret information. You have indeed crystallised what my issue is in this situation there!
timrogers 14y ago
Unfortunately though, you don't support .uk :(

aeden 14y ago

If you can get your transfer codes from them without having to give your password over the phone then start transferring now. You lose none of your registration period and you can find other registrars that don't suck. Even if you find a way to get what you want done with 1&1 you probably don't want to be doing business with a company that can't follow the most basic of security best practices.

timrogers 14y ago
I probably will!

tptacek 14y ago

Perhaps I'm misunderstanding the nature of this complaint, but it sounds like this guy is dealing with a service at which: * Tier 1 customer service people do not have plaintext access to customer passwords, and * Tier 1 customer service people do not have the ability to manipulate customer accounts without their passwords (and thus consent). On the scale of security/customer-service interactions at service providers, this sounds like MONUMENTAL EPIC WIN. What exactly am I missing here? And, How on earth could you possibly input a password into some random text field in an application that you would not provide to the CEO of the company hosting that text field?

timrogers 14y ago
I'm not convinced that the Tier 1 customer support reps do lack access without the password. It just seems to me like a misguided attempt at verifying identity. As for your second point, all that is based on trust in the company that they're not storing in plain text and opening it to the CEO...which I hope is the case for most companies. I was more trying to give a sense that I'm really not happy giving my password to any person. When it's a web form, you just have to have trust or the whole idea of passwords is broken.
- tptacek 14y ago
  In case you missed it, the subtext of my comment is that neither of those bulleted items are true for most service providers. At most large service providers, you can count on tier 1 CSA's having direct plaintext access to your password and those CSA's being a mouse click away from taking any action on your account you can conceive of. Your first point is just innuendo, right?
  - timrogers 14y ago
    I'm not sure I understand what the point you're trying to make is. In a hypothetical (but unlikely) world where they <really> did need my password to manage my account, this would be a poor practice to have and it should have some kind of other verification, even if it was character [x] and [y] of my password. The same applies if they don't need it really...this doesn't seem a good idea regardless.

alternize 14y ago

while I agree 1&1 shouldn't ask for passwords... why not just temporarily change your password to something stupid, call support, and then change your password again?

timrogers 14y ago
I could (and may well) do that, but my issue is more one of principle. I could do this, but it shouldn't be necessary.
adrr 14y ago
Because its easier to complain about it.

timrogers 14y ago

What registrars are good who support *.uk domains? I've had good experiences with Gandi previously.

ollysb 14y ago
+1 for Gandi, I've only heard good things about them. I've been with fasthosts.co.uk for 10 years now(with zerigo for as long as I can remember as well), I've currently got 20 domains registered with them and I can't remember having had any problems with them.
- timrogers 14y ago
  I do like Gandi, they're quite pricey though. Shall have to compare prices across the board! Zerigo seem good though.
gmac 14y ago
I use Gandi and domainmonster.com. No problems with either.
drucken 14y ago
For personal/small setups, UKReg.com Domainmonster.com 123-reg.co.uk All have solid reputations with 123-reg being the elephant in the industry but UKReg and Domainmonster having superb responsiveness and customer support.

degenerate 14y ago

Thanks for reminding me I have an expiring domain to transfer away from them!

IndianGuy79 14y ago

I have been long time user of 1and1 for domains. Their initial product offering is always sweet (free, 1$ domains) etc. Their renew rates are not bad as well. But the place where I hated them most was NS change propogation, it took 24 hours to get that done. Also their admin panel is awfully slow. If you guys don't already know it, here are some of the links to help To transfer/cancel domains you must go through : http://cancel.1and1.com http://cancel.1and1.com Admin: http://admin.1and1.com http://admin.1and1.com

pjl 14y ago
1and1's Control Panel is quite painful to use, but you don't have to go through cancel.1and1.com to transfer a domain - just make sure your domain is unlocked and you have the EPP code handy.

manaskarekar 14y ago

FYI: So does Citicards.

axusgrad 14y ago

Change the password to 1and1sucks, call back, and give them that. Oh wait, now everyone knows your new password.

suresk 14y ago

This doesn't sound good, but it got me thinking.. How do you verify someone is who they say they are in situations like this? As we've seen with recent breaches, the last 4 digits of your CC # aren't incredibly hard to find out. "Secret" questions and answers are generally quite poor, in that very few of them don't suffer from laughably small keyspaces or rely on semi-public information. Passwords almost seem like the least bad option. I get that giving a password to a human isn't a very comfortable feeling, but if you don't trust the CSR to not misuse the password, do you also not trust the developers to not have put in something to grab your password one of the various times you enter it into a web application that they control?

tzs 14y ago
Assuming that all you need to verify is that the person on the phone knows that account name and password, one way that would not be too difficult to implement would be to have a way for support to mark the account with a random 8 digit number. The support person does this, and then tells the customer to log in to their account management page. There should be a link there that shows the random 8 digit number. The customer then reads this to the support person over the phone.
- suresk 14y ago
  Something like that would certainly work - I was thinking a one-time code could be emailed to the email address on the account, but either way would be fine. Given the relative simplicity, I wonder why nobody (at least that I know of) has implemented something like this?
  - saurik 14y ago
    This is how PayPal support works: you use the website to get a random six-digit "customer support PIN" which you then dial in when you connect to their system.
    - nthj 14y ago
      Media Temple operates this way, as well. I like this approach, as I can never remember those "4-digit account pins" (looking at you, AT&T), and I'm happier knowing any given pin is only usable for the next hour, anyway.

fosap 14y ago

I don't get it. At all. The only purpose of the password is to authenticate you against your account. Why would you refuse to use it for this? It's the point of a password that you submit it.¹ Oh yeah. Because you don't trust the guy on the telephone. He could easily hijack you account and do nasty stuff. 1) He could do if he wanted if you didn't tell him 2) You're not trusting him/her? Why are you doing any business with a company you don't trust? Or is the point that somebody could wiretap you? Get off your tin foil hat and think about keyloggers. ¹) Or do a challenge response. It does not matter. It's a shared secret.

timrogers 14y ago
The point is simply that established practice is to never share passwords, and this eschews that practice. I can see your point, but they have a variety of other data they could use to verify who you are. This is about the worst idea.
- deleted 14y ago
  [deleted]
- nowarninglabel 14y ago
  Actually, no it's way above better than other ways they could verify your identity. Did you not read account of the Wired reporter who had his online identity stolen and wiped because companies used easily obtainable information about the person to identify the person's identity? If they had used a password instead it never would have happened. I don't understand what your issue is with telling them the password? Just change it to something random and change it back after if it's not something you are comfortable sharing or saying out loud. It may personally offend you, but t's certainly not a bad practice.
- fosap 14y ago
  No, that's not true at all. Every time you log in you share your password. That's the point of a password. (unless it's some fancy public/private key stuff).

jiggy2011 14y ago

To be honest, I've asked customers for passwords over the phone before. Usually it's because they have called reporting a problem with their email, now about 70% of the time it's because of a problem at their end but I have to humour them anyway. Now I can of course access their mailbox by going into a shell on the server but the quickest way to check everything and satisfy the customer is to setup their email account on my computer and check I can get it to work. Since the passwords are securely hashed, the only way I can do this is by asking for the password from the customer.

rhizome 14y ago
I see that as a failure of process. Your tools should already be constructed in a way that using them is easier and more reliable than asking for a password. Coupled with auth logging on the server side to diagnose failures on their side, there really should be no reason to ask for a password for this stuff.

crisnoble 14y ago

Personally I think it is hilarious to say things like "ampersand" or the "little carrot arrow thing err.. you know shift six" over the phone. I once had to leave my password in a voice-mail to my nurse, she told me "most people just make it something simple like their doctors name you know." I refrained from launching into a tirade about the importance of strong unique passwords.

stretchwithme 14y ago

I recall when I first heard of this outfit. I think it was 10 years ago. They wanted you to fax forms over to them. Perhaps early man got his domains that way.

eli 14y ago
My recollection is that in the bad old days of Network Solutions, you have to fax in domain registration and change forms. I seem to recall someone stealing a big brand's domain name for fun simply by faxing in some instructions on bogus letterhead.

circa 14y ago

I hate 1and1. I had to deal with their awful Website interface for a client of mine recently. I had to transfer over 100 GB of stuff on this guys "unlimited" storage account. they capped the speeds around 500KB/s. it seriously took all week. uploading to amazon and rackspace cdn's were a godsend after that.

VMG 14y ago
As a long customer in Germany, I can only agree. They have a lot of shady practices and I wouldn't recommend them to anyone.

dave1010uk 14y ago

I had this with Virgin Media (UK ISP). I called them and the support guy asked for my secret password. I assumed it was a security answer so I went through a couple of obvious ones like mother's maiden name. After a few attempts, he stopped me and said my password was strange because it was just a bunch or random characters. At this point I realised that not only was he expecting my actual account password for verification but it was available in plain text for him to manually verify!