7 ms·

This is probably just some customer service mistake, not a systematic failure. Why do people take isolated examples of uneducated, misinformed customer service

This is probably just some customer service mistake, not a systematic failure. Why do people take isolated examples of uneducated, misinformed customer service reps, and blow them into raging complaints damning the entire company? I'm starting to see this regularly. Take a deep breath before you spew out some diatribe on your blog.

viraptor 13y ago
Oh no, it's definitely the company's fault. Any real service where support may need to get involved will provide the support people with an admin interface or a way to login as the user without their password. That's the standard way to do it. If they didn't provide that and didn't explicitly say "never ask for password", that's really the company's fault.
- fantnn 13y ago
  Maybe they have this and were still unable to reproduce it, and the uppity intern working support tried to go (in his/her eyes) go above and beyond to fix it. I agree with parent comment, knee jerk reaction to this kind of stuff is stupid. Seems to be "women in tech" who always feel compelled to fucking blog about it too.
- odonnellryan 13y ago
  Where's the window's admin interface to log in as another user...?
  - Ensorceled 13y ago
    "su - user" has existed for at least 30 years. Oh, right, Windows. Using Windows as a counter point to any argument on best practices is silly. But even then, as your domain admin, I can reset your password, login as you and then reset a new temporary password for you. I have done this and would never ask a user for their password. Even on windows.
    - mschuster91 13y ago
      ...which wipes out access to my OS-level encrypted files, thank you very much dear admin
      - Ensorceled 13y ago
        Which, again, is another reason not to use windows...
        odonnellryan 13y ago
        True, but, I think the most-used software isn't a "bad" example to use in an argument.
        Ensorceled 13y ago
        I think it is when that most-used software is notoriously insecure. Certainly when used as a standalone argument. But hey, minor point :-)
  - skywhopper 13y ago
    runas.exe: http://technet.microsoft.com/en-us/library/bb490994.aspx http://technet.microsoft.com/en-us/library/bb490994.aspx
    - odonnellryan 13y ago
      (I know there's software for this) but that doesn't let me use the environment as the user. Lots of times, things are profile related.
  - viraptor 13y ago
    1. I wrote service as in service provided on the web, not software. I'm sure online office (360, live, or whatever the name is this week) support has the ability to get to your documents though. 2. There's runas. 3. There's lots of examples of software that allows you to use the system remotely. Some of them have signatures in the virus databases, some don't.
    - odonnellryan 13y ago
      > I'm sure online office (360, live, or whatever the name is this week) support has the ability to get to your documents though. I have an admin account for an Office365 subscription, I can absolutely NOT impersonate a user. From what I know, Microsoft can not either. Runas doesn't let me "see the error the user has"
      - viraptor 13y ago
        You're assuming that admin account has the same or more privileges as a local MS's support account. Is there a reason for that?
        odonnellryan 13y ago
        Well, you assumed a lot of stuff in your post, too.. But yes. Microsoft will actually reset your password, or ask you for it, to troubleshoot O365 problems. Very standard.
RALaBarge 13y ago
I think one of the comments someone left on the blog itself rings true: "Wow, you are a hell customer." I'm willing to bet Squarespace is happy the OP is leaving their service, I know I would be if I were in their shoes. Granted, it is a case of bad support, but as Colin mentions, it is likely an issue with an under trained new hire, not a systematic failure.
- rmrfrmrf 13y ago
  Hmmm smells like the HN misogynists are out again. Someone should really do a sentiment analysis on HN comments based on author gender.
  - xauronx 13y ago
    If it helps anything, I came to the same conclusion and didn't realize the author was a female until your post brought it to focus.
    - Ensorceled 13y ago
      Well, it helps that you didn't call her an "egotistical bitch" :-) You can agree that she might be wrong but I think the sentiment is that some of the people that are disagreeing with her are being specifically sexist in their method of disagreement.
  - DanBC 13y ago
    She makes a reasonable point. Someone comments "Wow, you are a hell customer. In the future, set a temporary password. They were trying to help you and you have to be a mouthy egotistical bitch. I'm sure they're happy to see you go. As someone in customer support, I'm sure they're happy to see you go. Egotistical hipster bitch." For not wanting to give her password to customer support she is somehow a "mouthy egotistical bitch", a "hell customer", etc. And yet you get down voted for mentioning the misogynist word?
- prof_hobart 13y ago
  You don't think there's a systemic failure if under-trained new hires are on the front line requesting passwords? If they've not been educated about not doing that, there's a fair chance they aren't going to be too smart around other big security issues either - such as resetting passwords with very little validation of whether it's the genuine customer requesting it or not.
rmrfrmrf 13y ago
If you understood how customer service business runs, you'd know that this is most definitely a systematic failure. I'm shocked how many people on HN seem to think that customer service reps act on their own volition. And if Squarespace is really that bold as to allow untrained individuals to handle customer service, the first thing they should be trained on is to NEVER ask for a password. The author of this post is 100% correct in leaving a company she doesn't trust and warning readers that that behavior is entirely unacceptable.
- jcc80 13y ago
  If you understood how customer service business runs, you'd know that this is most definitely a systematic failure. I'm shocked how many people on HN seem to think that customer service reps act on their own volition. There is no uniform customer service business or uniform training. Having worked in companies with support departments, there is a wide variance. Some are tightly scripted, others are given almost free reign and simply told to resolve issues quickly. edit: of course, password through email is big no-no.
  - scrabble 13y ago
    Password through anything is generally a no-no. Your service should have a way of accessing user accounts without their password.
    - erddojo 13y ago
      No. There are plenty of services where your pw is encrypted locally, so your service provider CAN'T access your account to fix something without your password. Many of the cloud storage providers do this. You want your files recovered, you'll have to hand over your pw (or not have the problem fixed).
- odonnellryan 13y ago
  They probably only get paid $10 an hour: how much training do you think they might have..?
sivetic 13y ago
Because it only takes one uneducated, misinformed customer service rep to cause a (small or big) security breach.

viraptor 13y ago

Oh no, it's definitely the company's fault. Any real service where support may need to get involved will provide the support people with an admin interface or a way to login as the user without their password. That's the standard way to do it. If they didn't provide that and didn't explicitly say "never ask for password", that's really the company's fault.

fantnn 13y ago
Maybe they have this and were still unable to reproduce it, and the uppity intern working support tried to go (in his/her eyes) go above and beyond to fix it. I agree with parent comment, knee jerk reaction to this kind of stuff is stupid. Seems to be "women in tech" who always feel compelled to fucking blog about it too.
odonnellryan 13y ago
Where's the window's admin interface to log in as another user...?
- Ensorceled 13y ago
  "su - user" has existed for at least 30 years. Oh, right, Windows. Using Windows as a counter point to any argument on best practices is silly. But even then, as your domain admin, I can reset your password, login as you and then reset a new temporary password for you. I have done this and would never ask a user for their password. Even on windows.
  - mschuster91 13y ago
    ...which wipes out access to my OS-level encrypted files, thank you very much dear admin
    - Ensorceled 13y ago
      Which, again, is another reason not to use windows...
      - odonnellryan 13y ago
        True, but, I think the most-used software isn't a "bad" example to use in an argument.
        Ensorceled 13y ago
        I think it is when that most-used software is notoriously insecure. Certainly when used as a standalone argument. But hey, minor point :-)
- skywhopper 13y ago
  runas.exe: http://technet.microsoft.com/en-us/library/bb490994.aspx http://technet.microsoft.com/en-us/library/bb490994.aspx
  - odonnellryan 13y ago
    (I know there's software for this) but that doesn't let me use the environment as the user. Lots of times, things are profile related.
- viraptor 13y ago
  1. I wrote service as in service provided on the web, not software. I'm sure online office (360, live, or whatever the name is this week) support has the ability to get to your documents though. 2. There's runas. 3. There's lots of examples of software that allows you to use the system remotely. Some of them have signatures in the virus databases, some don't.
  - odonnellryan 13y ago
    > I'm sure online office (360, live, or whatever the name is this week) support has the ability to get to your documents though. I have an admin account for an Office365 subscription, I can absolutely NOT impersonate a user. From what I know, Microsoft can not either. Runas doesn't let me "see the error the user has"
    - viraptor 13y ago
      You're assuming that admin account has the same or more privileges as a local MS's support account. Is there a reason for that?
      - odonnellryan 13y ago
        Well, you assumed a lot of stuff in your post, too.. But yes. Microsoft will actually reset your password, or ask you for it, to troubleshoot O365 problems. Very standard.

RALaBarge 13y ago

I think one of the comments someone left on the blog itself rings true: "Wow, you are a hell customer." I'm willing to bet Squarespace is happy the OP is leaving their service, I know I would be if I were in their shoes. Granted, it is a case of bad support, but as Colin mentions, it is likely an issue with an under trained new hire, not a systematic failure.

rmrfrmrf 13y ago
Hmmm smells like the HN misogynists are out again. Someone should really do a sentiment analysis on HN comments based on author gender.
- xauronx 13y ago
  If it helps anything, I came to the same conclusion and didn't realize the author was a female until your post brought it to focus.
  - Ensorceled 13y ago
    Well, it helps that you didn't call her an "egotistical bitch" :-) You can agree that she might be wrong but I think the sentiment is that some of the people that are disagreeing with her are being specifically sexist in their method of disagreement.
- DanBC 13y ago
  She makes a reasonable point. Someone comments "Wow, you are a hell customer. In the future, set a temporary password. They were trying to help you and you have to be a mouthy egotistical bitch. I'm sure they're happy to see you go. As someone in customer support, I'm sure they're happy to see you go. Egotistical hipster bitch." For not wanting to give her password to customer support she is somehow a "mouthy egotistical bitch", a "hell customer", etc. And yet you get down voted for mentioning the misogynist word?
prof_hobart 13y ago
You don't think there's a systemic failure if under-trained new hires are on the front line requesting passwords? If they've not been educated about not doing that, there's a fair chance they aren't going to be too smart around other big security issues either - such as resetting passwords with very little validation of whether it's the genuine customer requesting it or not.

rmrfrmrf 13y ago

If you understood how customer service business runs, you'd know that this is most definitely a systematic failure. I'm shocked how many people on HN seem to think that customer service reps act on their own volition. And if Squarespace is really that bold as to allow untrained individuals to handle customer service, the first thing they should be trained on is to NEVER ask for a password. The author of this post is 100% correct in leaving a company she doesn't trust and warning readers that that behavior is entirely unacceptable.

jcc80 13y ago
If you understood how customer service business runs, you'd know that this is most definitely a systematic failure. I'm shocked how many people on HN seem to think that customer service reps act on their own volition. There is no uniform customer service business or uniform training. Having worked in companies with support departments, there is a wide variance. Some are tightly scripted, others are given almost free reign and simply told to resolve issues quickly. edit: of course, password through email is big no-no.
- scrabble 13y ago
  Password through anything is generally a no-no. Your service should have a way of accessing user accounts without their password.
  - erddojo 13y ago
    No. There are plenty of services where your pw is encrypted locally, so your service provider CAN'T access your account to fix something without your password. Many of the cloud storage providers do this. You want your files recovered, you'll have to hand over your pw (or not have the problem fixed).
odonnellryan 13y ago
They probably only get paid $10 an hour: how much training do you think they might have..?

sivetic 13y ago

Because it only takes one uneducated, misinformed customer service rep to cause a (small or big) security breach.