Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I have had the same feeling – "this is okay, but could be way better"; I think a big part is in the lack of context.

Why on earth does the chat person need ask me my account number yet again? I am logged in to the website, they should be able to see that I am Account # 820914 and currently viewing Order # 788321.

Ensuring that this sort of context communication as the lowest bar for an in-app chat would go a long way towards making me prefer it to a conversation where I have to gather and route relevant information.



I never let call centers get away with asking me for account numbers over and over again without commenting on it; Amdocs and other vendors have had great software for keeping track of customer interactions between multiple people you talk to at a call center for 10+ years now. Management will make the usual excuse ("we can't afford it") but you can turn that around and ask "how can you afford to pay people to ask the same questions over and over again?"


At a hospital or clinic, it is common to be repeatedly asked your name and birthdate, even by the same nurse. It's not because they don't remember your birthdate. It's a procedural security measure in a busy, complicated environment to minimize how often they mistakenly hand you a bottle of someone else's pills.

I imagine this might be similar.


It's not. Hospital personnel do indeed ask you the same questions repeatedly to make sure they're treating the right person, but online vendors rarely have such high consequences attached to getting this wrong.

I suspect the real answer is that when they finally hand you off to a live human being, that human is sitting in the boiler room of a third-tier contractor on a different continent than the main headquarters of the business, and they have no idea what you're currently looking at on your screen. It's technically possible to do this handoff with a complete picture of how the user got there, but that requires a degree of technical integration most companies don't seem to want to pay for.


To be fair, in my experience they almost always tell explain the reasoning for repeatedly asking this information "for security reasons I must confirm your information again". Maybe I was just lucky with good places and people, but I never had wondered why the heck they need the information they already have on file (or worse, that I have already told them some minutes ago), because from their brief explanations I understand that they have some form and they must type in my data in there for verification.


> I never let call centers get away with asking me for account numbers over and over again without commenting on it; Amdocs and other vendors have had great software for keeping track of customer interactions between multiple people you talk to at a call center for 10+ years now. Management will make the usual excuse ("we can't afford it") but you can turn that around and ask "how can you afford to pay people to ask the same questions over and over again?"

But presumably you are talking to customer-service agents, not representatives, and what are they supposed to do about it? I share your frustration, but this seems to be just a recipe for spreading that frustration, not for resolving it.

(Unless you meant something else, e.g., you are professionally involved in call-center design, in which case I applaud your being a voice of sense in that domain, and thank you for it!)


I am polite but firm most of the time with agents, but I do get chances to talk with people who have the authority to change things. Raising a stink and ‘let me talk to your supervisor’ really can lead to tickets getting forwarded to people who can fix the process or at least give agents training in how to avoid or manage ‘lights on nobody home’ situations.

Lately I have been facing a breakdown in business processes with my local electric utility that first disconnected my electricity because one of my tenants made a mistake. I think they finally understand that I have three services at two houses at one address, but I went through two periods since then of getting no electric bill for months (which I won’t let slide because the last time they stopped billing me I got disconnected.) Getting that fixed involved waiting three hours on hold which got me talking to regulators again. The crew building the new deck at the other house has also deferred work because they have been unable to get through to anyone there who can turn the service off temporarily so they can work near where the wire comes in.


> Why on earth does the chat person need ask me my account number yet again?

Because their integration isn't very good.

Ones I've used, as long as you've configured a way to resolve the user, it pops right up in the service side of the chat system.


> Ones I've used, as long as you've configured a way to resolve the user, it pops right up in the service side of the chat system.

Be scared of those. They typically use client side JavaScript to read a cookie to know which username is active.

There is usually no verification of that info, so obviously it could be faked by a malicious client.

The docs say that, but it's way too easy to just trust the info rather than setup a properly secure solution.


I could see that being really bad... A 'social engineer' could talk support people into helping them hijack an account.


I would love to watch the inevitable presentation we'll be seeing at some security convention within the next few years.


This is a good point. You can definitely verify a user off of context (signed tokens, etc.), but you're probably right that a lot of folks don't do a great job of that!




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: