[bitfolk] Proving that you are you

Hello, Today a customer popped up on IRC saying that they had broken their VPS and couldn't remember their account details in order to use the console / rescue VM. Unfortunately they had also at some point in the past disabled email password reset, so they were unable to regain access. My concern at that point was that since they had previously disabled email password reset they were obviously security-conscious, so I did not feel comfortable resetting their password and giving it out to them over IRC. Of course, I could see that the customer's service was down as claimed, which did lend weight to the story and meant that I could not just ignore the issue. In the end I asked the person on IRC to send me a photo or scan of a utility bill bearing their name and address as present in BitFolk's customer database, and on receipt of that I did reset their password. If it had been you in the customer's position would you have considered that reasonable? If you have disabled email password reset, are you comfortable with this being circumvented by someone who is able to present a convincing image of a utility bill to support(a)bitfolk.com? Perhaps you can offer some guidelines for how this should be dealt with in future so that there can be a consistent response. Suggestions revolving around the customer identifying themselves using public key crypto (PGP keys, SSH keys) are fine but do bear in mind that most customers have not presented either a PGP nor SSH key to me, and that would have to be done before it was actually needed. I could require that an SSH and/or PGP key be uploaded to the panel before the panel allows you to disable email password resets, though there would still need to be a plan in place for the inevitable case where the customer claims to no longer have access to any of the keys they have uploaded. Cheers, Andy -- http://bitfolk.com/ -- No-nonsense VPS hosting