HN security FAIL

Forums › Off topic › HN security FAIL

itxtme

2102 posts

Uber Geek

#72340 24-Nov-2010 18:09

I took my laptop in for a repair under warranty to Harvey Norman today. All went swimmingly until he asked if I had a password on my laptop. 'Yes' I said without offering it up and he stared at me waiting for me to call it out.

1) Giving out passwords to somebody I dont know is never going to happen
2) Inevitibly people use passwords in more than one place (no lectures please)
3) On the previous repair the lappy had they did not ask for a password, just installed an extra test account on the computer.

I saide to him under no cirumcumstances am I going to give my password and offered the solution they used by default last time to which he agreed. I cant believe people give access to their computers just willy niilly. I would hate to see pictures etc. stolen from our personal collection, emails of a sensitive nature copied or accessed, or stealing of movies/mp3's I have paid for!

Am I being too sensitive??

nakedmolerat

4625 posts

Uber Geek

Trusted

Lifetime subscriber

#409052 24-Nov-2010 18:13

no! this is why i never send my laptop to the shop

Lenovo

Shop now for Lenovo laptops and other devices (affiliate link).

BlakJak

1245 posts

Uber Geek

Trusted

#409057 24-Nov-2010 18:17

You're giving someone your hard drive with your data on it; the password is almost incidental if you're seriously worried about security.

On the other hand for many home users they don't store much of sensitivity on their system, so giving their password out means little anyway.

Different strokes for different folks (and circumstances).

No signature to see here, move along...

NZCoderGuy

513 posts

Ultimate Geek

Trusted

Kiwi Dev Studios

#409058 24-Nov-2010 18:20

Exactly.. and if you are a business customer or have a business laptop etc, its best to get an OnSite warranty.. the likes of what Dell offer. They come to you and fix, so no data goes anywhere..

--
Stephen
twitter/ NZCoderGuy / KiwiDevStudios

LennonNZ

2458 posts

Uber Geek

ID Verified

Trusted

#409064 24-Nov-2010 18:34

Do you expect the data to be still on the laptop after you get it back??

I'm pretty sure most places will make you sign something when you are sending it away/giving it to them that its up to you to make sure you have backups of the data as formatting etc the computer may be needed for various reasons. (even for testing)

I don't know why you sent it away but say it was a faulty CPU or fan they will have to run a test application which will test all parts of the computer after replacement which may mean HDD read/write tests (and thus deletion of all files)

If someone installed a test user on the computer they must of had admin access anyway which means you don't need your password to see all the files (unless you added it in before you gave it to them?)

CYaBro

4533 posts

Uber Geek

ID Verified

Trusted

#409074 24-Nov-2010 18:51

As already stated, if you want to give in your machine for repair, be prepared to get it back restored to factory settings with all your data gone! So make sure you have a full backup before handing it over.
And also, as others already said, if they have the laptop then a password isn't going to stop them getting at your data unless it is encrypted.

Opinions are my own and not the views of my employer.

lxsw20

3512 posts

Uber Geek

Subscriber

#409075 24-Nov-2010 18:56

LennonNZ: Do you expect the data to be still on the laptop after you get it back??

I'm pretty sure most places will make you sign something when you are sending it away/giving it to them that its up to you to make sure you have backups of the data as formatting etc the computer may be needed for various reasons. (even for testing)

I don't know why you sent it away but say it was a faulty CPU or fan they will have to run a test application which will test all parts of the computer after replacement which may mean HDD read/write tests (and thus deletion of all files)

If someone installed a test user on the computer they must of had admin access anyway which means you don't need your password to see all the files (unless you added it in before you gave it to them?)

Pretty much this, when I used to work for a repair agent we would call before deleting.

Its up to you at the end of the day, but if you value your time, just give up the password so it can be properly tested and not returned for further repairs.

Dunnersfella

4083 posts

Uber Geek

#409105 24-Nov-2010 19:46

Is your hard drive encrypted?
If not, then they can access your laptop and its content, with, or without you giving them a password.
If you have content on there that you don't want other people to see... um, either don't download it, or don't give other people your laptop.
I think it may be time to get a little more savvy about how you're operating unfortunately.

1080p

1332 posts

Uber Geek
Inactive user

#409178 24-Nov-2010 21:29

If possible you should remove the password on any devices you return for repair. Also remove/delete any sensitive data.

You have no idea the number of people who leave their porn/pirate film collection on their notebooks when sending them in for repair.

I always ask for a password over the phone, am yet to be denied one. I do not believe the lack of attention paid by most people to their privacy.

If I was denied a password over the phone (perfectly reasonable) but needed access to the account for troubleshooting I would send the unit back to the customer and request that the password be removed.

This is possibly irritating and a waste of time for the customer but equally a waste of my time in the majority of cases.

itxtme

2102 posts

Uber Geek

#409240 24-Nov-2010 23:58

Point was not in regards to losing data, the data has been backed up. My point was giving out a password and complete access to your laptop is to me dumb.

Like I said in the OP if you have a good read its about protecting access. If they have my password they can use outlook to send emails etc. It adds a layer of protection in that the data/applications/personal photos etc. are not just sitting there begging to be opened.

The only reason I was so put off by it was I use that password for multiple accounts, and they didnt require it for the previous repair!

FYI the charger is not supplying power, it must be sent to their repairer to confirm it is the adaptor and then a new one will be sent.

BlakJak

1245 posts

Uber Geek

Trusted

#409321 25-Nov-2010 09:25

Your fault for not changing the password to something generic/unique before sending the machine away then i'm afraid!!

If the techs are wanting to see what you're seeing, they need to be logged in as you. And sadly as much as you may be savvy enough to understand that the fault is not user-specific, they do need to be able to eliminate a layer-8 fault.

No signature to see here, move along...

Oblivian

7277 posts

Uber Geek

ID Verified

#409341 25-Nov-2010 09:55

Exact reason a reputable repair agent puts workers (ala me) through the standard SIS vetting regime, And include in my contract information regarding personal privay/data/retention clauses etc.

As stated, dependant on fault the repairers often need to confirm its not stuff that has been installed/user specific at fault.

For us, Immediate termination and legal action proceed any undue actions with customer PCs other than what is required to diagnose, test and repair faults.

The only time we have been allowed outside this, was with a stolen PC and a court order from the police. And to escalate a very serious obvious discovered case to the authorities.