<story><title>Rackspace passwords are visible to customer service</title><url>http://rondam.blogspot.com/2010/03/danger-will-robinson-rackspace-cloud.html</url><text></text></story><parent_chain></parent_chain><comment><author>LiveTheDream</author><text>I asked a Rackspace rep about this. Here is the real deal:&lt;p&gt;- passwords are NOT stored in cleartext&lt;p&gt;- however, passwords &lt;i&gt;are&lt;/i&gt; visible to customer service via a &quot;secure, non-public tool&quot;&lt;p&gt;- the reason for this is because &quot;people generally prefer to give out a password to authenticate themselves [over the phone] than portions of the billing information&quot;&lt;p&gt;- so if a user account database is stolen somehow, the malicious thief would not have access to convenient info like email/username/cleartext password. (However if a customer service rep is the bad guy, you&apos;re still in trouble since they have access to the tool.)&lt;p&gt;- at some point, Rackspace intends to &quot;removing CSR access for SAS-70 purposes and moving to something like a challenge/response like the Managed division uses.&quot; AFAIK SAS-70 is some kind of audit regulation, but the wikipedia article put me to sleep after reading the first sentence.</text></comment>
<story><title>Rackspace passwords are visible to customer service</title><url>http://rondam.blogspot.com/2010/03/danger-will-robinson-rackspace-cloud.html</url><text></text></story><parent_chain></parent_chain><comment><author>Terretta</author><text>Anyone that&apos;s ever logged into their control panel knows the control panel can show you your password with a button click.&lt;p&gt;If you&apos;re a Rackspace customer, you trust them run your network fabric and your hardware.  They don&apos;t need your password to see what you&apos;re doing, but you may as well trust them with that too.&lt;p&gt;Speaking of trust -- if your machine password gives a Rackspace CSR access to your app&apos;s private data, you&apos;re just as guilty as you&apos;re accusing them of being. You&apos;re not storing your private data in the clear, are you?&lt;p&gt;(As for why they might do this:  Most users aren&apos;t sophisticated enough to use a password generator and manager, making &quot;What&apos;s my password again?&quot; a common support question.  Providing the &quot;Show me my password&quot; function in the web control panel means a CSR doesn&apos;t have a job reason to look at it.  And even if they do, cloud customers already trust Rackspace support with the reboot switch, and for that matter, with the &quot;delete this whole image and all its backups&quot; button.)</text></comment>