Does T-Mobile Want To Steal My Identity?

It can be hard to tell real companies from scam artists sometimes. I got a call the other day from T-Mobile about my bill. They had overcharged me by $24 and I was late paying the bill because I wanted it fixed (and, in this economy, they call the day after it's due!). The discussion of why they would possibly think I wanted text messaging turned off on my account when I switched from a BlackBerry to a MyTouch is a topic for another post in the future

The T-Mobile agent who called me asked for part of my social security number to verify that I was who I said I was. I refused. Hey, you called me! How do I know you're not a scam artist? He told me that he was from T-Mobile and I should believe him, that, if I didn't give him my social security number, he couldn't help me. All things a scam artist would say, of course. The fact remains that I had no proof he was who he said he was.

I tried to explain to the guy that T-Mobile should never, ever ask a question like that because, to the extent that people answer it, you're training them that it's OK to give your confidential information to somebody who calls you on the phone. You're enabling scam artists. Unfortunately, he just didn't get it.

The rules are simple. In the world of client-server architecture, it's known as "never trust the client". In the real world, it's "never trust somebody who calls you."

• Never, ever give confidential information to somebody who calls you, even an innocuous thing like an account number. You don't know that they are who they say they are.
• If you call somebody, never, ever ask for confidential information when you call somebody. If you need confidential information, ask them to call you back at a number which is posted prominently on your web site or which is well known (like 1-800-T-MOBILE).

Is Comcast Helping Scammers?

Comcast wants to fight scammers, but they're inadvertently going to help them.

Comcast, like all Internet service providers, is directly impacted by so-called botnets, machines that have been hijacked by viruses and other malware to serve as robots in the service of scammers. The botnets are useful to the scammers because it allows them to send spam and launch attacks from many locations instead of a single location, which makes them much harder to catch and shut down.

Comcast's idea is to inflict popup ads on their customers that appear to be compromised. which provide them with information. According the the AP article, the ad says "Comcast has detected that there may be a virus on your computer(s). For information on how to clean your computer(s), please visit the Comcast Anti-Virus Center."

There are a couple of problems with this:

• To the extent that it works, it trains people that popup ads that claim to be helping you clean your computer are legitimate. The problem is that, with this sole exception, none of them are.
• It trains people that clicking on a link in an unexpected popup ad is an ok thing to do, when it almost never is.
• It trains people that something like this can be trusted, when it's very easy to fake it.

I don't like the popup in any event, but, if they're going to do it, I think there are a couple of things they must do:

• The popup shouldn't look at all like an ad and it certainly shouldn't mimic any OS feature.
• The popup should contain no (that's zero) links in it. Just to be clear: None. Instead, the ad should say "... please visit comcast.com in your browser and click on the xyz link ..." Train people not to click on links like that and train people that the only way to know for sure that they're actually on the comcast site is to go to comcast themselves, not to trust a link.
• The popup should not have any button in it. No close button. Nothing to click on at all. Just "Close this window after you've read it." Don't train people to click buttons in unexpected popups.

And how about thinking if there's a better way to attack the whole problem, like doing something in concert with Microsoft and Apple (OS vendors), or Microsoft, Mozilla, and Google (browser vendors).

Stupid Password Policies

I have a friend who has a whole bunch of passwords written down, on a whole bunch of Post-It notes, right next to her computer. Why on earth would she do that? Well, it's not her fault. It's the fault of overzealous web sites that not only force her to have complex passwords, but have conflicting rules. She can't make up one password that she uses everywhere.I frequently recommend that people make up a rule for their passwords -- for example, name of their dog and a number, followed by something they can associate with the web site. This way they only have to remember a single, simple password but have a more complex password. This way, they might have passwords like spot3nile for Amazon, spot3junk for Ebay, spot3green for American Express, etc. But even this fails miserably because there are so many different conflicting standards. It's all part of the fake security that so many web sites have.Here are some of the password policies that I've seen recently:

• no restrictions at all
• 6 or more characters, no restrictions
• 6-8 characters, at least one non-letter, symbols are recommended
• 6-8 characters, at least 1 letter and at least 1 number, and at least 1 symbol
• 6-8 characters, at least 1 letter and at least 1 number, and at least 1 symbol
• 6-8 characters, at least 1 letter and at least 1 number, no symbols allowed
• 8-12 characters, at least 1 uppercase, 1 lowercase, 1 number, no symbols allowed
• 6-8 digits

I'm sure the list could be much larger if I did some research. In addition to this, there are case-sensitive and case-insensitive passwords. The thing I hate the most is the insistence on an upper case letter (the USPS web site is one of the sites that does this). I invariably forget the requirement and can't log in. Maybe if their web site said "don't forget: our stupid password policy means that your password has an uppercase letter in it" it would help me. I even use one web site where they use a Flash object that times inter-character intervals to see if it's really you typing your password. If you don't type your password in the same way, they ask you one of three random follow-up questions to make sure it's you. Without fail, every single time I have logged in, I have been asked one of the follow-up questions. Why not just ask it in the first place?!To make the whole situation even stranger, many sites provide a password reset mechanism which is incredibly easy to break. All you need is my zip code and my mother's maiden name, or some nonsense like that. I don't think I've ever seen a question that my brother and my wife wouldn't know the answer to. Hell, my kids know most of the answers!Who exactly are these password policies helping? 

Update: Serendipity! Just saw a New York Times Bits posting on pretty much this same topic: Falling Over Fallback Password Questions. An extra point from a comment that I wish I'd remembered -- how many sites are there that, after requiring you to use a ridiculously long and complex password, that you may well be using on other sites, simply email it to you in plain text when you go through the reset mechanism? What are they thinking?