Best Buy's surprisingly insecure approach to new PC setup

[DainBramaged]

Want Geek Squad to set up your PC? Just write your e-mail and password in that box on the leftA basic rule of password-based security is "don't write down your password." A second rule might be "don't train people to write down passwords." And a third rule, which few follow, is "don't adopt password policies that lead to people writing their passwords down" (over-aggressive change requirements often have this effect, for instance).

Best Buy hasn't received the memo, apparently. This past Friday I came in contact with a surprisingly bad password policy in action as I shopped with my brother for his new computer in Scottsdale, Arizona. He had settled on an HP Windows 7 machine and was in the process of paying for it when a Best Buy employee handed him an 8.5” by 11” sheet of paper labeled “PC Recommendation Worksheet.”

Emblazoned with the familiar Best Buy and Geek Squad logos, one side contained a “new computer setup” form, where you can select antivirus software, Geek Squad tech support, data transfer services, Microsoft Office, and so forth. The other side had more of the same—along with a request for my brother’s e-mail and password, right below the fields for name, address, and phone number. Anyone reading this form would interpret it as a request for your e-mail address and e-mail password. And less-sophisticated users will fill it in, no questions asked. But we balked.

“So, why do you need my password?” my brother asked. The Best Buy employee quickly said, “you can just ignore that.” Intrigued, I asked the employee if I could have a clean copy of the sheet and he graciously complied. It’s good, because the sheet my brother filled in—without his password, of course—was taken by the Best Buy employee. You can see a scanned copy at the top of this post (click the image to get a larger view). Even though we were told to ignore it, my curiosity was piqued. Who and what is this meant for?

http://arstechnica.com/security/2012/05/best-buy-collecting-email-passwords/


I wouldn't buy a PC from thse clowns if they were the last store on earth

[Renew Deal]

1. This is meant for them to easily set up the new machine but...

It's ripe for abuse.

[onehandle]

2. At the Apple Store, a setup person works side by side with you to set up your purchase.

Apple consistently gets recognized for the best buyer and service experience.

[DainBramaged]

6. Best Buy, the more we can soak you for unnecessary shit, the better

This is strictly a profit center for them. One of my friends (in spite of my protestations) went there to buy a laptop. After he had chosen it, as he was paying for it they told him that without their $100 setup package, he would neither be able to access the Internet or watch movies on the laptop.



He walked, and bought a much better one for not much more online at Newegg (as I had first insisted), and he got it in two days.



He never admitted I was right.

[mactime]

3. i'm still confused

DO they expect you to give them the password that you want to use for your user account on the computer? Or do they want the email password so they can set up the email client?

[DainBramaged]

7. They were totally nebulous (read down in article)

[Romulox]

4. Oh, the "value" of cheap! A purpose-made PC to "too expensive", you see... nt

[IDemo]

5. I know the "brick-and-mortar" retail outlet is a convenient place to shop

But my advice to anyone who knows which end is which of a screwdriver should consider looking at Newegg, Softmart and other online sources for a motherboard, cpu, and other parts needed to assemble their own PC. I've done well over a hundred on the job and several at home so perhaps I'm biased, but you can save yourself some money and it isn't rocket science. Plus, you get the satisfaction of knowing you did the job and configured your new machine exactly the way you wanted.

[wandy]

12. Only way to fly!

[lastlib]

8. Just put seven little black dots in that field....

It'll look exactly like you typed it in.

[hobbit709]

9. I occasionally have to ask for a customer's password when I work on their computer.

I don't write it down and forget it by the time the computer leaves.

[CBGLuthier]

10. We bought several laptops there just last year

real good prices for christmas and all.

Just told them no and told them no and told them no. Left with our purchases without letting the geeks touch them. Nobody lied to me about any problems this could cause as that would have resulted in some serious shit. I spent a few years selling and maintaining computers, in this century even, so lying to me about them is a very large mistake.

I will admit that their tactics are bullshit but anyone who knows how to shop and knows about computers can survive them.

[mactime]

11. Agreed

If you know what you are doing it is fine to purchase there. But I feel they scare the uninformed buyer and pile on unnecessary services.

[Initech]

13. Me either - I'll never patronize Geek Squad.

Why would I pay tons of money for services I can do myself?