topic Re: Plusnet password visible to call centre staff in Plusnet Feedback

Plusnet password visible to call centre staff

dave12345678 — Mon, 19 Aug 2013 20:03:05 GMT

I called customer services recently and they prompted me for a couple of random characters from my password as part of the security checks. I wasn't sure what my password was and said as much to the person I was speaking to, and they responded by saying "it looks like quite a random one". I was quite taken aback by what they said , so I asked them if they could see my whole password, and they said they could. This is very bad practice and must mean that they store passwords in clear text within their system. Staff at Plusnet have access to your passwords (remember how you're always told you should never share your password with anyone) and if hackers get into their system and steal the passwords then without any form of encryption on those passwords their job has been made a lot easier.
Although my password was unique to my Plusnet account, I immediately changed it to a completely random one (my original one was semi random) and I strongly suggest that you do the same if you use the your Plusnet password on other sites.

Re: Plusnet password visible to call centre staff

VileReynard — Mon, 19 Aug 2013 20:11:47 GMT

But the new password is (presumably) visibile

Re: Plusnet password visible to call centre staff

avatastic — Mon, 19 Aug 2013 20:11:54 GMT

Every access to your password is logged by the system, so there is always a record of when a CSC Agent has had to look at it.
Additionally the passwords are probably stored encrypted but in a way that can be decrypted (rather than being stored as a one-way hash).
I believe it has also been said in the past the the systems used to store the passwords/retreive them are only accessible from an internal VPN and aren't directly connected to the internet.
This pops up from time to time, so I hope I've remembered everything!
Cheers,
A.

Re: Plusnet password visible to call centre staff

Razer — Tue, 20 Aug 2013 11:48:05 GMT

I have been concerned about this before. Another member said some time ago when I raised the issue that he believed staff only saw the characters you were asked for on the phone. I just assumed he knew what he was saying. Clearly that's not the case and the whole password can be seen. I'm not happy about that at all.

Re: Plusnet password visible to call centre staff

James — Tue, 20 Aug 2013 12:07:06 GMT

We have to be able to see the full password for troubleshooting issues.
I have raised this with the ICO before who had no issues with the way we do things.

Re: Plusnet password visible to call centre staff

Razer — Tue, 20 Aug 2013 13:31:24 GMT

If you need to use the password to troubleshoot, the system should do it in a way where it is not shown and can only be used by the system in an automatic fashion, otherwise it is fundamentally insecure, whatever the ICO may say.

Re: Plusnet password visible to call centre staff

Tulner — Tue, 10 Sep 2013 19:37:47 GMT

Quote from: James
We have to be able to see the full password for troubleshooting issues.
I have raised this with the ICO before who had no issues with the way we do things.

Please can you tell me in detail why you need to see my password for "troubleshooting"
I am literally furious right now after being on the phone and being told that all call centre advisors can see my full password.
I was NEVER informed my password was going to be viewable to other people when I signed up.
No other operator does this at all.
Most have a seperate security question and answer and that is all they need.
This is a great way to loose customers as right now I am on the verge of cancelling my installation and going elsewhere after this, it is just beyond belief to me that in this day and age you are doing this.
Pretty much every single other decent company say " we will never ask your password"
First question you asked me when I rang "what's your password?"
I mean seriously? You think this is fine?

Re: Plusnet password visible to call centre staff

Mav — Tue, 10 Sep 2013 19:46:29 GMT

T-Mobile frequently ask for the full password when phoning them. I have asked several times why and have never, as yet, got a satisfactory answer.

Re: Plusnet password visible to call centre staff

Tulner — Tue, 10 Sep 2013 19:52:30 GMT

Well I am literally feeling right now unless I get a proper answer to why they need to have my password in clear text then I will be phoning and cancelling the install and going elsewhere.
It is bad enough to do it, but then to give the answer of " its for troubleshooting" is ridiculous. They can see something they should not be able to see, how about they actually give us the full reason. And I am pretty sure if they contact the "ICO" they will tell you that you need to give us that reason, not just fob us off.
TBH I find it very difficult to believe the ICO gave the go ahead for it at all. And I will be contacting them myself about this.
also I tihnk Plusnet would find if it was general knowledge they done this they would loose a lot of customers, in this age people do not take kindly at all to having information that should be secure and known only to them being viewable to an entire call centre.
Thanks.

Re: Plusnet password visible to call centre staff

dvorak — Tue, 10 Sep 2013 19:53:44 GMT

Quote from: Tulner

Please can you tell me in detail why you need to see my password for "troubleshooting"

Because the portal password is the same as that in the xDSL router and if you are having issues connecting it's helpful to know that the correct password is being entered into the router.
This will no doubt raise the question (again) for having separate xDSL password and portal password. But there isn't and there won't be iirc.
There are already topics about this.

Re: Plusnet password visible to call centre staff

Tulner — Tue, 10 Sep 2013 19:56:08 GMT

Ok then why the hell is the password the same?
How hard is it for you to use a different password?
You would rather annoy your customers and be insecure due to lazyness? Seriously?
I have not even had the damn thing installed yet and I already want out, these business practices are lazy, anti-consumer and in my opinion a breach of my data protection.

Re: Plusnet password visible to call centre staff

dvorak — Tue, 10 Sep 2013 20:00:09 GMT

Firstly it isn't me, I'm a customer like you.
Secondly I'm not sure what the CSC could do maliciously even if one of them decided to copy my username and password.
Thirdly it's laziness

Re: Plusnet password visible to call centre staff

Tulner — Tue, 10 Sep 2013 20:02:09 GMT

You are also a moderator for their forum and therefore represent the company when you post.
And with the attitude you give of correcting my spelling rather then actually act in a professional manner, you reflect just as bad an image as this whole fiasco does.

Re: Plusnet password visible to call centre staff

w23 — Tue, 10 Sep 2013 20:04:00 GMT

The moderators do not represent the company, this is a community forum moderated by customer volunteers.
Staff are identified as such under their name.

Re: Plusnet password visible to call centre staff

Tulner — Tue, 10 Sep 2013 20:05:53 GMT

Sorry who are you?
I am a customer, I came to the official forum on the official site, I see a "moderator" they are in authority on the Plusnet forums.
First thing customer thinks is they are part of Plusnet.
Therefore they represent the company.
As anything they say can affect the company's image.
Just because they do not work for Plusnet does not mean they do not represent the company.

Re: Plusnet password visible to call centre staff

dvorak — Tue, 10 Sep 2013 20:11:34 GMT

I, like the other moderators, in no way represent the company, have special insight or privilege and time is given voluntarily with no reward.
Our role is purely to help with the smooth running and impartiality of the community forum.

Re: Plusnet password visible to call centre staff

Tulner — Tue, 10 Sep 2013 20:13:56 GMT

Quote from: dvorak
I, like the other moderators, in no way represent the company, have special insight or privilege and time is given voluntarily with no reward.
Our role is purely to help with the smooth running and impartiality of the community forum.

Once again, you DO represent the company.
You post on their official forums with "moderator" under your name.
That is all you need to "represent" the company. You have been given power by the company therefore you represent them with everything you post on these forums.

Re: Plusnet password visible to call centre staff

picbits — Tue, 10 Sep 2013 20:21:14 GMT

As far as I remember, Moderators were voted in by members on here weren't they ?

Re: Plusnet password visible to call centre staff

dvorak — Tue, 10 Sep 2013 20:22:45 GMT

Of the three current three, 2 were elected by the members and one was approached by the moderators at the time independently.

Re: Plusnet password visible to call centre staff

Anonymous — Tue, 10 Sep 2013 20:24:24 GMT

Thread about moderator elections here - http://community.plus.net/forum/index.php/topic,114194.0.html