9 ms·
Squarespace: They Asked for My Password.
- surjithctly 13y agoGlad they didn't ask mail password :-P
- danpalmer 13y agoGiven that most people re-use a very small set of passwords across many services, they essentially did.
- PaulFreund 13y agoAnother way to look at this is to be happy that they had to ask for the password...
- Kesty 13y agoWhile it means that customer repcan not see the password or that the password is hased, they should have a system to let them acces your account without asking for your password.
- iagooar 13y agoYou should write Squarespace and ask if this is their standard process. I suspect that it could be a new support employee who is still learning how to handle this kind of stuff.
- rmrfrmrf 13y agoAbsolutely not. Given how mechanized customer support is these days, there is no reason to ask for login credentials. A new support employee would no doubt be reading off of a prompt and a seasoned support employee should absolutely know better.
- RALaBarge 13y agoLots of assumptions here.
- smackfu 13y agoI only assume that Squarespace is either having support people follow a script, or is training them well enough that they don't need to follow a script. Either way, they shouldn't be asking for passwords. Other people seem to be assuming that Squarespace is having untrained people do support, which is a much more damaging assumption.
- odonnellryan 13y agoI've been involved in helpdesk operations for a while. I've never been involved with a corporation, large or small, that has any kind of script. Hell, they rarely have a knowledge base....
- smackfu 13y agoBy script, I mean standard procedures. "For this problem, do this. If it doesn't work, try this." And if you don't have that, yeah, you are going to get wildly varying quality of support.
- odonnellryan 13y agoThat's fair enough. When the software is simple, that shouldn't be a problem.
- danpalmer 13y agoI can see a few possibilities here: 1. Squarespace don't have the engineering to support their support team's work, therefore they need passwords. This is unlikely, but if it's the case, people should avoid Squarespace, or at least using their support system. 2. They do have the engineering support, but their support team don't know how to use it and just ask for passwords. Given how much they emphasize support, I find this unlikely, but again, if the case you should avoid using them. 3. A new starter on the support team hasn't been run through all of the details about how to use the support system yet. This strikes me as the most likely, and not grounds for avoiding Squarespace. It should be pointed out to them, privately, so that they can emphasize customer password security in their training process for support staff.
- MartinMcGirk 13y agoI had a couple of minor styling issues once with one of Squarespace's templates. I emailed customer support and they pretty much could not have handled it any better. They were in constant contact with me and fixed both my problems (which required dev team action) quickly and totally to my satisfaction. I was never asked for my password and I doubt very much if that's normal procedure. Without trying to sound like some shill account, I can tell you that Squarespace made a loyal customer out of me by giving me the kind of support they promise, but which I had previously assumed was sales-talk-BS. I'm going to say it was a case of number 3 on your list.
- deleted 13y ago[deleted]
- grayrest 13y agoI worked at Squarespace for two years as a developer. Neither support nor engineering needs a password to diagnose and fix problems. I can't actually think of anything on the system that would require this so my first thought is that the support rep's machine or account has been compromised. Could also be an extremely poor decision on the rep's part but I never ran across another case in a couple hundred escalated issues.
- narag 13y agoNo big deal. But requesting top posting in red is outraging :-)
- rmrfrmrf 13y agoYikes! So glad to know that these type of things are being broadcast to the wider Internet community. I know quite a few people that use squarespace; I'll make sure to let them know.
- colinbartlett 13y agoThis is probably just some customer service mistake, not a systematic failure. Why do people take isolated examples of uneducated, misinformed customer service reps, and blow them into raging complaints damning the entire company? I'm starting to see this regularly. Take a deep breath before you spew out some diatribe on your blog.
- viraptor 13y agoOh no, it's definitely the company's fault. Any real service where support may need to get involved will provide the support people with an admin interface or a way to login as the user without their password. That's the standard way to do it. If they didn't provide that and didn't explicitly say "never ask for password", that's really the company's fault.
- fantnn 13y agoMaybe they have this and were still unable to reproduce it, and the uppity intern working support tried to go (in his/her eyes) go above and beyond to fix it. I agree with parent comment, knee jerk reaction to this kind of stuff is stupid. Seems to be "women in tech" who always feel compelled to fucking blog about it too.
- odonnellryan 13y agoWhere's the window's admin interface to log in as another user...?
- Ensorceled 13y ago"su - user" has existed for at least 30 years. Oh, right, Windows. Using Windows as a counter point to any argument on best practices is silly. But even then, as your domain admin, I can reset your password, login as you and then reset a new temporary password for you. I have done this and would never ask a user for their password. Even on windows.
- 13y ago
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- mastersk3 13y agoIt is obviously a case of untrained, newbie customer rep who would've thought 'Getting access" meant requesting Username and Password.
- cliveowen 13y agoI didn't know you could host a static website on DropBox. Anyone knows how much traffic can handle such a site?
- eli 13y agoEnough to share a link with some friends. Definitely not enough to link something from HN.
- mikegillman 13y agoYeah, that's not going to work very well.
- ryanmo 13y agoIt will work fine for low traffic sites if hosted out of the now deprecated Public folder. Sites like pancake.io, scriptogr.am or site44.com use the API, which don't have bandwidth caps on the Dropbox side
- andrewjkerr 13y agoI actually encountered this with my registrar Enom. I reached out to them on Twitter with no response, but, in their FAQ section, sure enough the instructions were to email your domain name and password. Needless to say, I changed that password and jumped ship. If any service requires your password as verification, it's definitely a good idea to look into other services.
- bevacqua 13y agoThe comments in that article are too damn retrograde
- purge 13y agoI was somewhat dumbfounded when I was asked for my apple id and password when I went to get my screen replaced at the apple store. After some debate with more senior team members, I reset my password to something generic and gave it to them, but it sets a bad precedent for customers who should be educated into never giving their password, under any circumstances.
- Ensorceled 13y agoYears ago I tried out SquareSpace and was having problems copy and pasting content into their editor. Basically they told me to first paste into TextEdit, convert to plain text and copy and then paste from there. When I explained that was a non-starter they pointed out I could switch to Windows and use IE or Firefox. Yes, SquareSpace customer support actually recommended I switch from Mac to Windows to use their service.
- henderjon 13y agoIf they're trying to recreate the issue, and are unable to do so, doesn't it speak well of SS that they DO NOT have a way to access a users account? Granted, asking for a password is poor form, but if that's the ONLY way to recreate an issue given that SS can't just access a users account, I don't think its worth blasting them for it.
- christacollins 13y agoHey folks, Christa from Squarespace here. I'm the VP of Customer Care, and would appreciate a moment to respond to some of the comments and concerns expressed here. To be clear, it is our stated policy to not ask for security credentials over email. All of our 150+ customer care team members receive proper training, both during on-boarding and on an ongoing basis. This incident was quite simply an example of human error. The support request was troubleshooting a mobile app interaction with our legacy Squarespace 5 product. This is a rare example of our team not being able to login as the user. One of my team members made a mistake, and for that our entire team apologizes. The proper action would have been to escalate to engineering or ask the customer to create a temporary password. We will of course use this as a teaching moment and continue to strive each and every day to improve in our efforts to deliver world class support to all of our customers. Sincerely, Christa