Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

To be honest, I've asked customers for passwords over the phone before. Usually it's because they have called reporting a problem with their email, now about 70% of the time it's because of a problem at their end but I have to humour them anyway.

Now I can of course access their mailbox by going into a shell on the server but the quickest way to check everything and satisfy the customer is to setup their email account on my computer and check I can get it to work.

Since the passwords are securely hashed, the only way I can do this is by asking for the password from the customer.



I see that as a failure of process. Your tools should already be constructed in a way that using them is easier and more reliable than asking for a password. Coupled with auth logging on the server side to diagnose failures on their side, there really should be no reason to ask for a password for this stuff.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: