3 ms·

I think the pitchforks may have been lit a bit early here. The password all support staff can see is for phone verification, and is completely separate from the

I think the pitchforks may have been lit a bit early here. The password all support staff can see is for phone verification, and is completely separate from the online log in password [0] However, Virgin don't seem to have clarified if and how the online log in password is hashed. [0] -https://virginmedia.response.lithium.com/portal/conversation/3957067 https://virginmedia.response.lithium.com/portal/conversation...

kungpoo 11y ago
Oh dear... "Only Virgin Media staff are able to view your password in an camera free enviroment. How would you take care of peoples sensitive banking details? MCr" https://virginmedia.response.lithium.com/portal/conversation/3957001 https://virginmedia.response.lithium.com/portal/conversation...
lcmatt 11y ago
The password is the one you tell them on initial setup of the account, they'll ask you for a memorable word to verify that it's the account holder they're talking to. This isn't anything to do with account logins etc. No different than companies asking you to verify your DOB and address to prove who you are.
- MattBearman 11y ago
  Memorable word! That's the term I was trying to think of, thank you! If they called it that in the tweets this whole thing probably could have been avoided.
pflats 11y ago
Yeah, for the people confused, "authentication codeword" might be a better way to think of it. This is not the traditional password, this is akin to the phone support version of your mother's maiden name. If I were to call up Virgin and say, "Hey, this is MattBearman, I want to add a phone to my account and an international calling plan," they need a way to verify that I am MattBearman. Instead of asking for personal information, they ask for an "account password" which is not your online password and is only used for the purpose of identifying the caller. It has to be plaintext or encrypted; they're not going to give you a hashing algorithm to work out over the phone.
- onion2k 11y ago
  They could give you a 2 factor auth device when you set up the account.
- itsybitsycoder 11y ago
  Well, in theory they could just tell the phone rep the unencrypted password and the phone rep could enter it into the system and the system could tell them if the hash matches. That's pretty much how it happens with most websites these days anyway. But I can see there's a big benefit in the rep being able to accept passwords which are obviously (to a human) the same, but would hash differently.
shultays 11y ago
Still, the common implementation in my country is you are forwarded to an automatic service which inputs your pin.
- Nashenas 11y ago
  In the US, it's still extremely common for carriers to have a phone PIN number just for the purpose of making changes through a phone call. If the user fails to remember that, they are asked more questions about private personal information to verify the account. Horrible practice, but very standard in the US.
a_bonobo 11y ago
Like I wrote below in a different post, the pitchforks have been justified since at least 2011: http://plaintextoffenders.com/post/4983474119/virginmobile-co-uk-virgin-mobile http://plaintextoffenders.com/post/4983474119/virginmobile-c... I'm with virgin mobile australia and I get the same mail when I click on "Forgotten Password" when I try to log into my online account to pay my bill.

kungpoo 11y ago

Oh dear... "Only Virgin Media staff are able to view your password in an camera free enviroment. How would you take care of peoples sensitive banking details? MCr" https://virginmedia.response.lithium.com/portal/conversation/3957001 https://virginmedia.response.lithium.com/portal/conversation...

lcmatt 11y ago

The password is the one you tell them on initial setup of the account, they'll ask you for a memorable word to verify that it's the account holder they're talking to. This isn't anything to do with account logins etc. No different than companies asking you to verify your DOB and address to prove who you are.

MattBearman 11y ago
Memorable word! That's the term I was trying to think of, thank you! If they called it that in the tweets this whole thing probably could have been avoided.

pflats 11y ago

Yeah, for the people confused, "authentication codeword" might be a better way to think of it. This is not the traditional password, this is akin to the phone support version of your mother's maiden name. If I were to call up Virgin and say, "Hey, this is MattBearman, I want to add a phone to my account and an international calling plan," they need a way to verify that I am MattBearman. Instead of asking for personal information, they ask for an "account password" which is not your online password and is only used for the purpose of identifying the caller. It has to be plaintext or encrypted; they're not going to give you a hashing algorithm to work out over the phone.

onion2k 11y ago
They could give you a 2 factor auth device when you set up the account.
itsybitsycoder 11y ago
Well, in theory they could just tell the phone rep the unencrypted password and the phone rep could enter it into the system and the system could tell them if the hash matches. That's pretty much how it happens with most websites these days anyway. But I can see there's a big benefit in the rep being able to accept passwords which are obviously (to a human) the same, but would hash differently.

shultays 11y ago

Still, the common implementation in my country is you are forwarded to an automatic service which inputs your pin.

Nashenas 11y ago
In the US, it's still extremely common for carriers to have a phone PIN number just for the purpose of making changes through a phone call. If the user fails to remember that, they are asked more questions about private personal information to verify the account. Horrible practice, but very standard in the US.

a_bonobo 11y ago

Like I wrote below in a different post, the pitchforks have been justified since at least 2011: http://plaintextoffenders.com/post/4983474119/virginmobile-co-uk-virgin-mobile http://plaintextoffenders.com/post/4983474119/virginmobile-c... I'm with virgin mobile australia and I get the same mail when I click on "Forgotten Password" when I try to log into my online account to pay my bill.