User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It only takes a minute to sign up.
Sign up to join this community
In almost every chat window I open, there's this fairly obvious statement:
Never tell your [password/credit card/social security/etc] to anyone.
Are there some standards for chat functionality that require this statement be put in place? Is it there to prevent liability when their account is inevitably hacked when they do share their password?
This statement seems obvious enough to warrant omitting it - why actually include it in every single chat dialogue?
A better modification of such a statment which I see being used is:
'A company_name employee will never ask for your password'
This message alerts the user that if the person is asking for a password, there is something fishy and he should alert the concerned authorities immediately. With all the live chat functionalities that most industries are providing, this is a good safety measure to keep the user informed.
Most security breaches are from social engineering, and so telling someone that they should never under any circumstances give anyone their password is an attempt to increase security. I would suggest a statement more like:
If anyone asks you for your password, you should assume they are a criminal and report it immediately!
Idea provided by @Kaz
As a more computer savvy person, you may think this goes without saying, but you would be shocked at how many people give their password to other people. I've even had an old lady at an ATM ask me to help her withdraw money, and before I realised what she was doing, she told me her pin code.
I was surprised to learn that teenagers share passwords much more than I expected.
So maybe for some demographics, it is necessary to reinforce more secure behavior.
It's a practice perpetuated by corporate legal counsel and made somewhat necessary by our litigious society. It is silly and slightly insulting but, fortunately, we all do it so we all look equally insulting.
Chat programs, e-mail programs, and most non-SSL web pages transfer information back and forth in a clear text format. This means that it's non-encrypted and readable by anyone with access to the text.
Even though the network your computer is connected to seems like a physical straight connection to the router or switch, or maybe the because you've connected your wireless network adapter to a wireless router or modem, the communications to those devices are not two-way in terms of network traffic. Basically everything on a network goes to everything else, and just like a radio broadcast tower sends out a signal in all directions, so does a wireless network card. The difference is the two items communicating both broadcast to each other with information stating the intended destination. Anything on the network has the potential to log all traffic passively and undetected.
People spend countless hours writing applications that scrape and datamine sites that contain logs of interactions and transcripts of chats looking for information in specific formats. Once a match has been found that information is stored. Also people will sit in public places like coffee shops, airports, and private neighborhoods collecting any information they can from over the airwaves or off of networks. Then later they datamine the collected information for patterns such as username/password combinations, social security numbers, credit card numbers, and even something as simple as email addresses.
This day and age most sites will request that your password be at least 8 characters long and contain random characters. This is the same reason your airplane seat cushions float; to quote Fight Club "the illusion of safety." There are machines that can crack passwords extremely fast. And Social Security numbers are not unique based on the number of people in the country & the number of digits possible in the Social Security Number. Credit card numbers are equally guessable/calculable.
While it doesn't take a lot of work to write a program to guess any of these numbers it does require several attempts to be able to use a number paired with other information effectively without sending up a red flag. Meaning even though someone guesses your password hash they still need to find out your username. Also they need to provide your name and some sort of identification, plus your social security number before they buy that new car you didn't know you were going to pay for.
This is where the statements "don't share your information with anyone" come into play. Just as most companies are slightly worried about being sued for breach of information, they are extremely afraid of negative PR associated with someone stealing identities on their systems because a chat log, e-mail log, web log, or a router log has been compromised. This is evident by the large numbers of attorneys on the payroll at Fortune 500 companies. They also cover themselves with the Terms of Service.
Other than placing the warning buried in the terms and conditions of the site they should indicate specifically how the information is being used. Here are a few examples.
It's definitely a "better safe than sorry" tactic, but I feel that these messages are meant more for the non-tech savvy user.
I've worked with several older clients that are simply unaware of such vulnerabilities.
Ultimately, it also depends on the audience of the site. I doubt github or stack exchange will have such messages.
However, if you're a bank, that may be a different story.
That statement is kept in its place mainly for first time users who haven't yet understood the requirement of a password. Another reason for that would be so that the owner of the site can avert any responsibility in case of passwords getting hacked due to reasons other than the obvious security failure of the website. As you may already know, experienced users dont go about sharing their passwords with anyone. You really cant trust anyone these days, even friends, as internet pranks are increasing in number.
It is actually obvious, as we observe that the chat/ social forums/ or any other site!
The sites are free to open an account (in most cases). So any one can open an account with fake details/fake account created on another mail hoster(as only email verification is taken as to avoid unauthorized users). In this case some new users who is new to IT, mostly retired persons(or any good harted person in name of donation may be), do post some sensitive details after few conversations.(alert!!!)
The chat basically takes place with the IRC protocol that is not secure in most cases, and the details in chat are easy to trace, track, and store. So, not a good medium either to pass on this kind of detail even if you know the person on other side is goo guy.
This is general precaution taken by companies as to avoid the name(defame) in news that using there medium user was affected.
I am not sure if more reasons are there... :)
The number of passwords I've been given unsolicited over the years is amazing--yet in almost all cases I make it clear I want the person to do the login themselves rather than giving me the password. The only time I can recall actually asking for a password was when I didn't want to have to TeamViewer into their system in order to manipulate yet a third system.
To make it worse people's password breeches can have ripple effects. I probably know the email password of every employee of one company. The passwords are plenty strong against an uninformed attack but from knowing two of them I could guess the rest.
It's a reminder, in some certain situations we might forget, it's better to have it there.
