May 29, 2009

You are hanging on a VERY thin thread

Hyang Zhao joined SL a month earlier than I did, in September 2006, and soon started to work as an official SL mentor, helping new users find their way around SL. Hyang is a community figure, well known to a lot of residents. Hyang is also a Premium member, paying hard currency to Linden Lab each month. Hyang comes from Russia, which makes some things more difficult compared to Western users, but Hyang takes it with a smile. The next software crash, redmapping or power/network outage might be the death sentence for Hyang Zhao, and she will never be able to get back into SL again.

Yesterday, Hyang changed her password on the SL website, something a sensible person should do every once in a while. Something went wrong during the process, a wrong click, a typo, something simple that can happen to anyone, and suddenly Hyang was locked out of the system. The options for password recovery given were:
  • Last amount of US$ transaction
  • Name 3 friends
  • Answer security question
According to Hyang - who was in a state of mild panic when she IMed me - she answered the friends question but the system refused the answer. This lead to the request of calling a phone number in the US which is quite expensive from Russia:
Are you having a little trouble with your password or security question? We can get this straightened out by talking to you. Please call us: (866) 476-9763.
I started a live chat session with LL Support on her behalf, and they confirmed there is no way around phoning them:
LL Support Employee: The only way we can reset a password is by speaking to the account holder, so she will need to call us
Eventually Hyang called the US number, and got asked for the security question which - in her case - was what her favourite book is. She got it wrong. She entered the security question in 2006, and since then tastes have changed, new favourites were added, and she did not recall which book she claimed back then. Linden Lab Support refused to reset her password, even after Hyang identified herself with real name, address, credit card number etc. - no valid answer to the security question, no password reset.

This got me wondering, what my security question might be. I set it almost three years ago, and even thinking about it hard I can not recall what it might have been. So alarmed by Hyang's experiences I tried to update my security question, but unfortunately you can't do it yourself. So I opened a ticket and asked them how to do it:
Dear Peter, Thank you for contacting Linden Lab support.
In response to your query regarding changing your security question. This can only be done via calling us on the below telephone numbers and requesting this via the phone call. Kind Regards, Brian, Linden Lab support.
Hum. I better call them and have that sorted out. Hyang's experience shows that all that separates you from digital oblivion is that security question. So you better know damn well what you entered there!


9 comments:

Nuuna Nitely said...

Oh wow! I have noooo idea what my security question even was!

Morgana Hilra said...

I think i am safe, i believe its my mothers madian name..

dandellion Kimban said...

I don't have an idea what my security question is. And it's quite silly on Linden's behalf to expect people to call them on the phone to reset the password. how that is supposed to prove that you are who you are supposed to be? On the other hand there is three friends question (which seems not to work, luckily). I can name three friends of at least dozen people.
Normal services do password reseting via email. Credit Card number seems to be quite a proof of an identity. But no, they have to complicate it with phone calls to their center that is always busy.

This shows one more thing. LL is so US centric. Which is bad for company whose less than a half of clients are in the US.

Boy Lane said...

The secret question is a feature for automated recovery with some webform. That's just an additional security measure for *AUTOMATED* password recovery.

If I call a support hotline and request personal support they are supposed to reset my account based on the information they have and they can verify using their *HUMAN* brain. It's absolutely unacceptable to use such secret questions as one and only form to prove your identity.

My account was hacked in the past and my RL details were changed. I still don't know how this could have happend but that was the info I got from LL that time. This means it's impossible to use such data including a secret question *ONLY* to verify a persons identity. Shame on LL to show us again how much they care for their residents. Support working with standard scripts they can't leave, standard email replies, nobody takes responsibility but rather playing the support ball to someone else and NO HELP for the one affected.

Anonymous said...

Yikes... I totally forgot about the security question.
I totally second dandellions comment that LL srsly lacks a developed international approach on this topic (and several other topics too).

Anonymous said...

Ok I will go out on a limb here - about 1 year ago, I have a close SL friend who told me to NEVER change my password because LL's password system is so screwed up. I also cannot remember what security question I chose. However, I'm absolutely astonished that after identifying herself in RL - LL is unable to help? This is just boneheaded stupidity.

Ari Blackthorne™ said...

...OR...

Create three alts, put them into your friends list (on all four accounts).

:)

Good point though. I signed on in '06 and can't remember the question. Though if available I always pick the same question (prt's name) whenever that particular security set-up is required.

I've had to do the "revocer/change" password thing once. It was back in 2006 about three or four months are I was in-world.

It was when there was a breech in LL servers and tyey forced every resident to change their password (I think concurrency back then was like 7000 or something LOL!)

Well, I enterred it wrong. Had to do the three friends thing. Damned if I couldn't get that right. The problem is the spelling of the LAST NAME.

We have long-time friends it bizarre how you just 'know' them - like a face in a crown, and don't realize that if you have to write out their name exactly - that last name could stump the hell out of you.

Kate Amdahl said...

That's horrific! I have to echo Boy: that's simply not a defensible way to do business. What scares me more is knowing that historically, if you think Linden Lab is doing something in a very wrong way, you have no recourse. Must they rule the world, if they're not going to be conscientious about it?

Ivanova Shostakovich said...

Did she ever get it sorted? It would really be a drag to lose everything.