Edit - User Experience Stack Exchange

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

Is a "Never tell your password to anyone" message in chat really necessary?

In almost every chat window I open, there's this fairly obvious statement:

Never tell your [password/credit card/social security/etc] to anyone.

Are there some standards for chat functionality that require this statement be put in place? Is it there to prevent liability when their account is inevitably hacked when they do share their password?

This statement seems obvious enough to warrant omitting it - why actually include it in every single chat dialogue?

Answer*

The evils of the modern information age.
----------------------------------------

Chat programs, e-mail programs, and most non-SSL web pages transfer information back and forth in a [clear text][1] format. This means that it's non-encrypted and readable by anyone with access to the text.

Even though the network your computer is connected to seems like a physical straight connection to the router or switch, or maybe the because you've connected your wireless network adapter to a wireless router or modem, the communications to those devices are not two-way in terms of network traffic. Basically everything on a network goes to everything else, and just like a radio broadcast tower sends out a signal in all directions, so does a wireless network card. The difference is the two items communicating both broadcast to each other with information stating the intended destination. Anything on the network has the potential to log all traffic passively and undetected.

People spend countless hours writing applications that scrape and datamine sites that contain logs of interactions and transcripts of chats looking for information in specific formats. Once a match has been found that information is stored. Also people will sit in public places like coffee shops, airports, and private neighborhoods collecting any information they can from over the airwaves or off of networks. Then later they datamine the collected information for patterns such as username/password combinations, social security numbers, credit card numbers, and even something as simple as email addresses.

Does it matter?
---------------
This day and age most sites will request that your password be at least 8 characters long and contain random characters. This is the same reason your airplane seat cushions float; to quote *Fight Club* "the illusion of safety." [There are machines that can crack passwords extremely fast.][2] And Social Security numbers are not unique based on the number of people in the country & the number of digits possible in the [Social Security Number][3]. Credit card numbers are equally guessable/calculable.

While it doesn't take a lot of work to write a program to guess any of these numbers it does require several attempts to be able to use a number paired with other information effectively without sending up a red flag. Meaning even though someone guesses your password hash they still need to find out your username. Also they need to provide your name and some sort of identification, plus your social security number before they buy that new car you didn't know you were going to pay for.

This is where the statements "don't share your information with anyone" come into play. Just as most companies are slightly worried about being sued for breach of information, they are extremely afraid of negative PR associated with someone stealing identities on their systems because a chat log, e-mail log, web log, or a router log has been compromised. This is evident by the [large numbers of attorneys][4] on the payroll at Fortune 500 companies. They also cover themselves with the Terms of Service.

What should responsible companies do about it?
--------------------------------------------------

1. [Store partial credit card numbers][5] in a database or make people provide their CC#s every time.
2. Delete live logs from the server or router after a short amount of time (after they've been backed up if neccessary)
3. Encrypt backups and logs
4. Immediately strip anything that looks like personal data from a public listing where it looks like someone is sharing personal information.

How could they go about warning the user?
=========================================
Other than placing the warning buried in the terms and conditions of the site they should indicate specifically how the information is being used. Here are a few examples.

1. Warning: Everything on this website is public and searchable in a search engine.
2. Providing your personal identification to someone allows them to steal your identity.
3. This website does not screen criminal histories of its users. Be careful when meeting face-to-face.
4. Due to the nature of the internet, online gameplay may not be suitable for children under 18.


  [1]: http://en.wikipedia.org/wiki/Clear_text
  [2]: http://arstechnica.com/security/2012/12/25-gpu-cluster-cracks-every-standard-windows-password-in-6-hours/
  [3]: http://en.wikipedia.org/wiki/Social_Security_number#Structure
  [4]: http://www.law.yale.edu/documents/pdf/CDO_Public/Final_LIB_Guide_2011_-_Public.pdf
  [5]: http://www.networksolutions.com/education/cisp-compliance/

Edit Summary*

Cancel

Add a comment |

Correct minor typos or mistakes
Clarify meaning without changing it
Add related resources or links
Always respect the author’s intent
Don’t use edits to reply to the author

create code fences with backticks ` or tildes ~
```
like so
```
add language identifier to highlight code
```python
def function(foo):
print(foo)
```
put returns between paragraphs
for linebreak add 2 spaces at end
_italic_ or **bold**
quote by placing > at start of line
to make links (use https whenever possible)

<https://example.com>

[example](https://example.com)

<a href="https://example.com">example</a>

formatting help »
answering help »