Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

In almost every chat window I open, there's this fairly obvious statement:

Never tell your [password/credit card/social security/etc] to anyone.

Are there some standards for chat functionality that require this statement be put in place? Is it there to prevent liability when their account is inevitably hacked when they do share their password?

This statement seems obvious enough to warrant omitting it - why actually include it in every single chat dialogue?

share|improve this question
41  
You can't fix stupid, is 'Caution this Coffee is really hot and will burn you!!!' really necessary on coffee cups? Yes, because it wasn't there and someone filed a law suit over it. –  ryan May 13 '13 at 21:52
7  
Even if it seems obvious to you, it's not obvious to everyone - when I managed a corporate IT helpdesk, about every week someone would drop off a computer with a sticky note with their password or send the password in an email. When we tell the users not to do that their common reply is "Well what's the harm, you're IT so you can get into the computer anyway" (which is true, so we don't need the password!). –  Johnny May 13 '13 at 23:30
20  
hunter2. Oh, and, @ryan, try educating yourself about the McDonald's hot coffee case: it's considerably more complicated than you might imagine. –  TRiG May 14 '13 at 1:44
9  
@TRiG I have read up on the entire case, and what I said was a gross over simplification, but it doesn't make that trend any less true. There are instructions on pop-tarts that say remove from foil before putting in toaster, or on hot-pockets after they come out of the microwave it says in big bold letters: CAUTION CONTENTS ARE HOT... They are called Hot Pockets and I just put them in the microwave, thank you for the warning that they might be hot... Can you really say that that warning is there for any other reason then to cover the companies liability? Can you really say that? –  ryan May 14 '13 at 4:51
10  
show 6 more comments

10 Answers 10

up vote 85 down vote accepted

A better modification of such a statment which I see being used is:

'A company_name employee will never ask for your password'

This message alerts the user that if the person is asking for a password, there is something fishy and he should alert the concerned authorities immediately. With all the live chat functionalities that most industries are providing, this is a good safety measure to keep the user informed.

share|improve this answer
15  
Not only is this more polite, but it gets to the heart of what the problem actually is (i.e. social engineering, as mentioned by John). –  Carter Pape May 13 '13 at 22:41
4  
It is more polite. But some will interpret that as meaning, they have to provide the password unsolicited. "How else would the company_name employee log into my account and fix my problem?" –  emory May 14 '13 at 15:20
3  
This is better than some website I used yesterday. I changed my password and got a message that "[company] will never ask you for your password.". Then on the VERY NEXT screen it asked me for my username and password. I know that's not what they meant but .... –  jcoder May 16 '13 at 12:34
    
It doesn't have to be pretending to be an employee. In Steam Chat for example, the message is necessary because in Steam's item trading, some people ask for someone's password pretending to need it for the trade, and some people are even stupid enough to give it then. By the way, the message is only shown to new users there, and disappears after a while. –  Jop Vernooij May 18 '13 at 10:23
1  
@Koviko ideally that would be a red flag in my book. –  rk. Jun 17 '13 at 13:16
show 2 more comments

Most security breaches are from social engineering, and so telling someone that they should never under any circumstances give anyone their password is an attempt to increase security. I would suggest a statement more like:

If anyone asks you for your password, you should assume they are a criminal and report it immediately!

Idea provided by @Kaz

As a more computer savvy person, you may think this goes without saying, but you would be shocked at how many people give their password to other people. I've even had an old lady at an ATM ask me to help her withdraw money, and before I realised what she was doing, she told me her pin code.

share|improve this answer
11  
The people that fall victim to social engineering already "know" they are not supposed to give that information to anyone. They are duped into believing that there is an exception. So the text really has to be a paragraph clearly explaining that under no circumstances will any legitimate agent ever ask for their secret information, and that anyone who does so should be assumed to be a criminal. –  Kaz May 14 '13 at 0:41
    
@Kaz Excellent point. I'm going to borrow the idea in a modified answer. –  JohnGB May 14 '13 at 1:10
21  
That old lady was not all that dumb. She gave her PIN to you, which you didn't ask for. The odds that someone you pick to give your PIN to will grab your card and rob your account are much lower than that someone who asks for the PIN will do the same. –  Kaz May 14 '13 at 1:14
6  
@Kaz It would be nice to think that she thought it through that well :) –  JohnGB May 14 '13 at 1:17
4  
Note to self: clean up and hang out around an ATM. Wait for old lady to approach. Do not ask for PIN but look helpful. Confederate will steal her purse at later time. In this case, I never asked for the password, I just created an environment where the victim felt comfortable sharing it with me. –  emory May 14 '13 at 15:43
show 1 more comment

I was surprised to learn that teenagers share passwords much more than I expected.

So maybe for some demographics, it is necessary to reinforce more secure behavior.

share|improve this answer
1  
I don't think there's a problem with sharing your password with a trusted user - my wife has the passphrase to a password vault where I keep my passwords. Of course, you need to be ready to change those passwords if that "trusted user" becomes untrusted. –  Johnny May 13 '13 at 23:33
2  
@Johnny You just hope that you change the password before they do :) –  JohnGB May 14 '13 at 1:19
add comment

It's a practice perpetuated by corporate legal counsel and made somewhat necessary by our litigious society. It is silly and slightly insulting but, fortunately, we all do it so we all look equally insulting.

share|improve this answer
1  
+1 for being at the heart of the matter. Everything everyone has said is true, but if our society was not so sue happy, and didn't expect every single little instruction to be laid out for them, these types of messages would not be necessary. As indeed they were not that common 50 years ago. Or even 15 years ago... –  ryan May 14 '13 at 16:18
    
How many times have you run up against a UX wall because of legal requirements that do nothing for the customer and little for corporate liability in the end? –  plainclothes May 14 '13 at 18:25
add comment

The evils of the modern information age.

Chat programs, e-mail programs, and most non-SSL web pages transfer information back and forth in a clear text format. This means that it's non-encrypted and readable by anyone with access to the text.

Even though the network your computer is connected to seems like a physical straight connection to the router or switch, or maybe the because you've connected your wireless network adapter to a wireless router or modem, the communications to those devices are not two-way in terms of network traffic. Basically everything on a network goes to everything else, and just like a radio broadcast tower sends out a signal in all directions, so does a wireless network card. The difference is the two items communicating both broadcast to each other with information stating the intended destination. Anything on the network has the potential to log all traffic passively and undetected.

People spend countless hours writing applications that scrape and datamine sites that contain logs of interactions and transcripts of chats looking for information in specific formats. Once a match has been found that information is stored. Also people will sit in public places like coffee shops, airports, and private neighborhoods collecting any information they can from over the airwaves or off of networks. Then later they datamine the collected information for patterns such as username/password combinations, social security numbers, credit card numbers, and even something as simple as email addresses.

Does it matter?

This day and age most sites will request that your password be at least 8 characters long and contain random characters. This is the same reason your airplane seat cushions float; to quote Fight Club "the illusion of safety." There are machines that can crack passwords extremely fast. And Social Security numbers are not unique based on the number of people in the country & the number of digits possible in the Social Security Number. Credit card numbers are equally guessable/calculable.

While it doesn't take a lot of work to write a program to guess any of these numbers it does require several attempts to be able to use a number paired with other information effectively without sending up a red flag. Meaning even though someone guesses your password hash they still need to find out your username. Also they need to provide your name and some sort of identification, plus your social security number before they buy that new car you didn't know you were going to pay for.

This is where the statements "don't share your information with anyone" come into play. Just as most companies are slightly worried about being sued for breach of information, they are extremely afraid of negative PR associated with someone stealing identities on their systems because a chat log, e-mail log, web log, or a router log has been compromised. This is evident by the large numbers of attorneys on the payroll at Fortune 500 companies. They also cover themselves with the Terms of Service.

What should responsible companies do about it?

  1. Store partial credit card numbers in a database or make people provide their CC#s every time.
  2. Delete live logs from the server or router after a short amount of time (after they've been backed up if neccessary)
  3. Encrypt backups and logs
  4. Immediately strip anything that looks like personal data from a public listing where it looks like someone is sharing personal information.

How could they go about warning the user?

Other than placing the warning buried in the terms and conditions of the site they should indicate specifically how the information is being used. Here are a few examples.

  1. Warning: Everything on this website is public and searchable in a search engine.
  2. Providing your personal identification to someone allows them to steal your identity.
  3. This website does not screen criminal histories of its users. Be careful when meeting face-to-face.
  4. Due to the nature of the internet, online gameplay may not be suitable for children under 18.
share|improve this answer
add comment

It's definitely a "better safe than sorry" tactic, but I feel that these messages are meant more for the non-tech savvy user.

I've worked with several older clients that are simply unaware of such vulnerabilities.

Ultimately, it also depends on the audience of the site. I doubt github or stack exchange will have such messages.

However, if you're a bank, that may be a different story.

share|improve this answer
add comment

That statement is kept in its place mainly for first time users who haven't yet understood the requirement of a password. Another reason for that would be so that the owner of the site can avert any responsibility in case of passwords getting hacked due to reasons other than the obvious security failure of the website. As you may already know, experienced users dont go about sharing their passwords with anyone. You really cant trust anyone these days, even friends, as internet pranks are increasing in number.

share|improve this answer
add comment

It is actually obvious, as we observe that the chat/ social forums/ or any other site!

  1. The sites are free to open an account (in most cases). So any one can open an account with fake details/fake account created on another mail hoster(as only email verification is taken as to avoid unauthorized users). In this case some new users who is new to IT, mostly retired persons(or any good harted person in name of donation may be), do post some sensitive details after few conversations.(alert!!!)

  2. The chat basically takes place with the IRC protocol that is not secure in most cases, and the details in chat are easy to trace, track, and store. So, not a good medium either to pass on this kind of detail even if you know the person on other side is goo guy.

  3. This is general precaution taken by companies as to avoid the name(defame) in news that using there medium user was affected.

I am not sure if more reasons are there... :)

share|improve this answer
add comment

The number of passwords I've been given unsolicited over the years is amazing--yet in almost all cases I make it clear I want the person to do the login themselves rather than giving me the password. The only time I can recall actually asking for a password was when I didn't want to have to TeamViewer into their system in order to manipulate yet a third system.

To make it worse people's password breeches can have ripple effects. I probably know the email password of every employee of one company. The passwords are plenty strong against an uninformed attack but from knowing two of them I could guess the rest.

share|improve this answer
add comment

It's a reminder, in some certain situations we might forget, it's better to have it there.

share|improve this answer

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

6  
Tea Nguyen, could you please elaborate giving more information? –  Deer Hunter May 20 '13 at 10:09
add comment

protected by JonW May 20 '13 at 11:10

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.