4 ms·
> never give out codes sent to use via sms or push notifications to someone requesting them via phone Unfortunately, some call centers DO use that for verifica
by gpt5 1y ago
> never give out codes sent to use via sms or push notifications to someone requesting them via phone
Unfortunately, some call centers DO use that for verification in some cases (i.e. you call them, and they send you a code to your email/phone that you read back).
- sroussey 1y agoI’ve personally never had that happen. It should go on a name and shame list.
- scrollaway 1y agoStripe Support does it for certain specific cases (email & phone). However, whenever they do it, it's a bilateral code generation: The support agent also gets a code they have to read out to the end user, which is featured prominently to them, saying the agent will have to read it out to get authentified.
- troc 1y ago- godaddy
- octo888 1y agoWho still uses GoDaddy LOL
- koakuma-chan 1y agoSmall business owners
- jay_kyburz 1y agoAlso me. Every 10 years my domains expire, and I can just pay a few hundred bucks again and forget about it, or I can do a bunch of work to move them somewhere and adjust A records and fuck around with stuff I don't remember and potentially have downtime.
- UltraSane 1y agoUse AWS Route53 it is so much better.
- koakuma-chan 1y agoBetter than CF?
- UltraSane 1y agoIf you mean cloudflare I have never used it.
- koakuma-chan 1y agoCheck it out, it's much easier to use and they don't charge any markup.
- UltraSane 1y agoOne thing I like about Route53 is how granular the permission can be. This lets you automate things more easily and securely.
- koakuma-chan 1y agoYeah AFAIK people use Route53 when, e.g., there is a need to automate making subdomains for customers and stuff like that.
- UltraSane 1y agoIAM permissions are almost always a pain to get right but they can be so useful when you can create an API key with permissions to do only exactly what it needs to do.
- adrr 1y agoMy bank does it. Chase will send OTP via the bank app to verify you're identity for phone support.
- clysm 1y agoChase bank…
- UncleMeat 1y agoChase did this to me. A million alarm bells but even after hanging up and restarting the conversation from a phone number publicly listed on their website as a support contact they still did it. Wild.
- rscrawfo 1y agoFidelity does as well, although the message switches to state only read the code if you've called them directly.
- jasode 1y ago>I’ve personally never had that happen. It should go on a name and shame list The key situation for giving out an SMS code that the gp is pointing out is the customer initiates the call to the support center. For example, suppose somebody wants to add a credit-card to their smartphone digital wallet. They have to call the bank issuing their credit-card to do that. Once the customer support person answers the call, a common security verification (e.g. Chase Bank does this) is for them to send you a 6 digit code to your phone. You then repeat this code back to the support person on the call. They want proof of your identity and also proof that you physically have the smartphone with you. Repeating the SMS code to the customer support person is safe because the customer called the official 1-800 number on the back of their card. That's a totally different sequence of steps from receiving a random call from somebody claiming they are from Chase Bank. Yes, in those cases, you never give out SMS codes to that untrusted person on the phone.
- NikolaNovak 1y agoI agree with everything you said. Note, however, that those are two "totally different sequences of steps" to you and I, and "completely analogous / equivalent sequences of steps" to my father in law :-/
- vehementi 1y agoJustifiable in a vacuum, but the end result is grandma knows "sometimes it's OK to give the code to the person on the phone"
- cced 1y agoThey should have users receive the code and then submit said code into the application for verification, with clear instructions that this code is produced as a result of a support call, and to confirm you are on an existing call when submitting the code. Doing so would not force users to divulge codes over the phone, and enable support staff to verify identity all without training users that reading codes over the phone is acceptable. Thoughts on that?
- deleted 1y ago
- delfinom 1y agoA lot of credit unions using a certain call center / credit card provider use this exact authentication mechanism over the phone.