Security exploit in classic chat widget?

Hi Jess!
 
I didn't have a good answer for this question, so I reached out to our product team that handles this area and they shared the following response with me. I'll just post it verbatim from them so that I don't make a mistake rewording it:
 

There are two types of end-users in Chat with respect to authentication:

1. Authenticated Users: Only the business-supplied details are used to identify an end user. This is achieved by the customer maintaining a signing server. Further details can be found here (https://support.zendesk.com/hc/en-us/articles/4408838925082-Enabling-authenticated-visitors-in-Web-Widget-Classic). Agents are not able to modify their details either. Identification is possible across multiple devices, as long as the business identifies them as the same users.
2. Non-authenticated Users: Unverified users, who may or may not have any identification information attached to them. This is the default behavior in Chat. Identification is based on a cookie, and does not carry across devices. Within this, there are two subtypes:
   1. Anonymous visitors: No identifying information is available about these end-users except the cookie. Chat attaches a random ‘Visitor 1234567890’ name to these, with the numerical part being random for each end-user.
   2. Self-identified visitors: In cases where a business modifies a user’s information, or there is a pre-chat form involved, an end-user can supply their name, email address and phone number. No further verification is done on this information, and the onus is on the business to verify this, if they choose to. Some businesses do this with a further OTP flow to the email/phone number.

 

There is clear UX differentiation between these types of end users, providing agents a clear signal of whether an end-user is authenticated.

1. Legacy Chat: In Legacy Chat, authenticated end-users have a green authenticated checkmark overlay on their avatar, as noted here. Agents are not able to modify their profile information. The only way to do so would be to use the APIs to re-identify the end-user. (https://support.zendesk.com/hc/en-us/articles/4408838925082-Enabling-authenticated-visitors-in-Web-Widget-Classic#topic_jsx_cvq_4fb)
2. Chat in Agent Workspace: In Agent Workspace, authenticated end-users also have a green authenticated checkmark during the course of an ongoing conversation, greatly reducing the risk of social engineering. This is in the form of a similar green authenticated checkmark next to their name in the ongoing chat log.