6 ms·
Yeah, for the people confused, "authentication codeword" might be a better way to think of it. This is not the traditional password, this is akin to the phone s
by pflats 11y ago
Yeah, for the people confused, "authentication codeword" might be a better way to think of it. This is not the traditional password, this is akin to the phone support version of your mother's maiden name.
If I were to call up Virgin and say, "Hey, this is MattBearman, I want to add a phone to my account and an international calling plan," they need a way to verify that I am MattBearman. Instead of asking for personal information, they ask for an "account password" which is not your online password and is only used for the purpose of identifying the caller.
It has to be plaintext or encrypted; they're not going to give you a hashing algorithm to work out over the phone.
- onion2k 11y agoThey could give you a 2 factor auth device when you set up the account.
- itsybitsycoder 11y agoWell, in theory they could just tell the phone rep the unencrypted password and the phone rep could enter it into the system and the system could tell them if the hash matches. That's pretty much how it happens with most websites these days anyway. But I can see there's a big benefit in the rep being able to accept passwords which are obviously (to a human) the same, but would hash differently.