Slightly unhelpful "help", thanks Spark-bot!

Forums › Spark New Zealand (including Skinny and BigPipe) › Slightly unhelpful "help", thanks Spark-bot!

jamesrt

1663 posts

Uber Geek
+1 received by user: 941

ID Verified

Trusted

Lifetime subscriber

#284567 30-Apr-2021 20:44

I'm not sure if I want to laugh or not; let's see what other people think:

Got the dreaded call from an elderly parent: "I have a computer problem..."

Email not working - Fat client on PC using POP3 to Spark/Xtra mail. A quick diagnosis showed his password wasn't working.

Turns out we can reset that via the Spark/Xtra webmail interface, by answering a security question. Fortunately, said parent remembered the security answer, which made that quite simple.

Re-entered new password into email client, and bingo: 3 days of emails appear.

Two of them are from Spark: "We noticed an attempt to gain access to your account, so have reset your password".

Well, great. Nice work for noticing, great effort in remedying the issue; but minus several million points for resetting a password, preventing access to email, and THEN EMAILING TO TELL THEM!

OK, said parent has a landline, mobile phone, AND internet with Spark; so it's not like they don't know his mobile number to at least have an automated SMS saying "you need to reset your XtraMail password"...

Am I being unrealistic in thinking that forced-resetting an email access password and the only notification being by email to the impacted email address is a REALLY BAD idea?

timmmay

20858 posts

Uber Geek
+1 received by user: 5350

Trusted

Lifetime subscriber

#2700258 30-Apr-2021 20:48

It's not ideal. Many people probably check email on multiple devices or webmail, so it's not as crazy as it initially sounds. A text message would be better.

richms

29098 posts

Uber Geek
+1 received by user: 10207

Trusted

Lifetime subscriber

#2700262 30-Apr-2021 21:01

If like most people the password is crap, and the access is from somewhere dodgy then its a correct and valid solution to prevent them from having someone get in there and all the damage that they can cause.

But remember the email is outsourced so the place that has the mailboxes and controls that probably doesnt have access to all that other information to get intouch with them. If it was done in apps with oauth and stuff properly, like things should be for a current internet era instead of passwords and pop3 and imap for the internet of 25 years ago, blocking new connections and alerting and allowing older ones would be possible.

But as email is stuck in the past all they can do is revoke the singlular password that all access uses and possibly send a login failure message which most email clients will ignore and just pop up some "friendly" BS about the account not working.

Is their account in haveibeenpwned at all with a crap password?

Richard rich.ms

jamesrt

1663 posts

Uber Geek
+1 received by user: 941

ID Verified

Trusted

Lifetime subscriber

#2700264 30-Apr-2021 21:18

richms: Is their account in haveibeenpwned at all with a crap password?

Yes & no; email address is listed as leaked, but most recent leak was 2018.

I know the email password was changed more recently than that; it's not 68 characters long with mixed case symbols etc, but it's not that bad, considering.

I'm probably slightly overreacting because I'm tired; but I still think the process could be improved; just not sure how to feed that into Spark at a high enough mgmt Level to make a difference...

SomeoneSomewhere

1882 posts

Uber Geek
+1 received by user: 1086

Lifetime subscriber

#2700316 30-Apr-2021 23:44

timmmay:

It's not ideal. Many people probably check email on multiple devices or webmail, so it's not as crazy as it initially sounds. A text message would be better.

Assuming that the password change does not immediately end all current sessions, which is *normally* standard practice.

snnet

1413 posts

Uber Geek
+1 received by user: 556

#2704089 9-May-2021 16:49

I think you bring up a very valid point - they need to let customers know in a way other than e-mail, especially if they have phone, postal address (if it has to be done this way), cellphone details

SirHumphreyAppleby

2938 posts

Uber Geek
+1 received by user: 1860

#2704092 9-May-2021 17:02

snnet:

I think you bring up a very valid point - they need to let customers know in a way other than e-mail, especially if they have phone, postal address (if it has to be done this way), cellphone details

How about an automated call saying there is a problem with your Spark account and to press 1 to speak to someone?

Geekzone

Want to support Geekzone and browse the site without the ads? Subscribe to Geekzone now (monthly, annual and lifetime options).

SomeoneSomewhere

1882 posts

Uber Geek
+1 received by user: 1086

Lifetime subscriber

#2704099 9-May-2021 17:09

SirHumphreyAppleby:

snnet:

I think you bring up a very valid point - they need to let customers know in a way other than e-mail, especially if they have phone, postal address (if it has to be done this way), cellphone details

How about an automated call saying there is a problem with your Spark account and to press 1 to speak to someone?

You mean like those calls from spark to tell you there's a problem with your computer and you need to install teamviewer? I'm sure making them automated will make them more trustworthy.

SomeoneSomewhere

1882 posts

Uber Geek
+1 received by user: 1086

Lifetime subscriber

#2704100 9-May-2021 17:11

Realistically, no action is really required here. They notice their password isn't working - and the email client should pass that message on - then reset the password or call the helpdesk themselves.

If you have a recovery email set up, that should also get the warnings about attempted access, but I'm not sure spark does that.

richms

29098 posts

Uber Geek
+1 received by user: 10207

Trusted

Lifetime subscriber

#2704103 9-May-2021 17:14

SirHumphreyAppleby:
snnet:

I think you bring up a very valid point - they need to let customers know in a way other than e-mail, especially if they have phone, postal address (if it has to be done this way), cellphone details

How about an automated call saying there is a problem with your Spark account and to press 1 to speak to someone?

Hahahaha you have not thought that they at all. Also noone likes getting automated calls even from legit places. They can sms people or email other contact emails but this is not something worth the intrusiveness of a phonecall.

Richard rich.ms

snnet

1413 posts

Uber Geek
+1 received by user: 556

#2704109 9-May-2021 18:12

an SMS with instructions to call spark would be helpful - with an officially recognisable number like *123

SirHumphreyAppleby

2938 posts

Uber Geek
+1 received by user: 1860

#2704111 9-May-2021 18:25

richms: Hahahaha you have not thought that they at all. Also noone likes getting automated calls even from legit places. They can sms people or email other contact emails but this is not something worth the intrusiveness of a phonecall.

You're right. How inconsiderate. It's not urgent, just run a batch script in the early hours of the morning and send a text instead.