Exercise 3: Why the Agent Never Asked for the User's Password — Possible Solution ==================================================================== WHAT HAPPENED IN THE SCENARIO ------------------------------ Per this chapter, "the setting requires re-entering an account password. The agent explicitly does not ask for it - the user types it themselves while the screen is briefly obscured." THE CHAPTER THIS REASONING CAME FROM ------------------------------ This is a direct application of Chapter 5's own warn-box: "never type a user's own password" during a screen-sharing session. Chapter 5 established that a support session, however trusted, should never involve the agent handling or even seeing the user's actual credentials - that boundary exists regardless of how much the user otherwise trusts the person helping them. WHY OBSCURING THE SCREEN WAS THE RIGHT SOLUTION ------------------------------ Simply asking the user to type their own password, without addressing that the agent could still *see* the screen while they typed it, wouldn't fully solve the problem - the password would still be visible during entry over the shared screen. Briefly obscuring the view (or otherwise pausing what's shared) while the user types closes that gap, keeping the credential genuinely private rather than merely "not typed by someone else." WHY THIS MATTERS EVEN IN A TRUSTED SESSION ------------------------------ The principle isn't about distrusting this particular user or this particular agent - it's a boundary that should hold in every session, regardless of how routine or friendly it feels. Treating credential handling as a fixed rule, rather than a judgment call made session by session, avoids the situation where a legitimate-feeling shortcut ("just tell me the password, it'll be faster") quietly becomes a habit. WHY THIS WORKS AS AN ANSWER ------------------------------ It states what the agent actually did instead of asking for the password, traces the reasoning back to Chapter 5's own explicit warning, and explains both why obscuring the screen was necessary (not just having the user type it) and why this boundary holds regardless of how trusted the session feels.