Personal Security Online

A colleague of mine told me that Streamyx's authentication server behaves in funny ways. During one downtime period, he tried logging in with his ID and used a mock password (he used bulls***) and managed to get through. This strategy, if true, is great for availability (as users wouldn't know if the authentication server was down), but terrible for security. On another occassion, someone who claimed to be from TMNet called his house and asked for his password. He dodged the question a couple of times and finally told him that it was set to default. He changed the password shortly after. A third instance of dubious security practices is when his password expired and he called the helpdesk to reset it. The helpdesk staff asked him what password he wanted, saying that it is more convenient for him to tell then, rather than go to the designated website to set it himself.

I wonder if this is TMNet's standard practice. Technicians and engineers should know better than to ask someone what their password is. Password retrieval should be an automated task between the customer and a system, especially in this case where the customer is actually paying for access.

Related links:
1. Sample Corporate Basic Password Policy
2. What is Social Engineering and how it relates to Computer System Security
3. Of Digital Identities