Ethics & Impersonation: Alternatives? [closed]

Question

Have you ever troubleshoot for your customer and ask (or really want to) their credentials to check their settings if the fault is there? Our solution to this is to implement impersonation feature to login as any users and have access to everything users do. In this case, a mail application. Although we don't need the password to impersonate, I however feel concerned about user's privacy. Mainly 2 things: Their mails and POP3/IMAP settings (which impersonator can get user's gmail/yahoo/etc user and password.

What are other good alternatives/suggestions around this?

Some suggested logs. Of course, it's essential component but you can't possibly log everything. Especially because there are so many things to log already not related to user's settings.

Answer 1

You need to have a method for the customer to be able to collect and send their settings to you with their knowlege and consent. Similarly for logs.

There should be no reason to essentially break into a customer's system to 'support' them.