Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

During an internship for a small company, my boss created an account for me, so I generated a password and I used it. The next day, my boss told me to write down the password of my account on a piece of paper, put it in a letter and to sign the envelope. Then he took the letter and told me that if he needs to access my account and I am unreachable, he is authorized to open the envelope and read the password to use it.

He also told me that this is a common practice in all companies. Now I don't know if every company does this (I don't think so) but, to me, it's not legal.

Let's say that my boss is a bad person (he's not) and he wants to frame me for something that he did. He only has to open the letter and read my password (let's say that I'm unreachable) and do his nefarious activity with my account.

Now let's say that I can't prove my innocence. How I can prevent all of this? I thought of writing down a wrong password, but if he really needs my account and I'm unreachable, I'll put him in a bad situation.

So, is there a way to protect myself (without refusing to write down the password)?

share|improve this question
9  
Maybe this question belongs on law.SE or workplace.SE? – Neil Smithline Jan 31 at 18:03
172  
FYI, this is not common practice – David Grinberg Feb 1 at 1:54
47  
Also, there's the question of why should your boss need to access your account in the first place. That's equivalent to saying that he needs to be able to impersonate you, which makes no sense. If he needs to read your files -- he can use an administrator account to read those; he doesn't need to impersonate you in order to do that, unless the files are encrypted with your password, which I suspect not (it would be kind of pointless given the context). – Mehrdad Feb 1 at 9:17
14  
Why go to all this trouble? He can get the admin to let him in anytime. – RedSonja Feb 1 at 10:04
6  
@Casey that's not necessarily true - entry into a computer system under false pretenses can be a hefty crime in a number of jurisdictions, including the US. – corsiKa Feb 1 at 15:56

14 Answers 14

up vote 121 down vote accepted

That's what the envelope is (or should be) for: In order to use your password, one needs to break the seal of the envelope you signed. When you think your password was abused, you can ask to see the envelope with your signature and check if it is still unopened.

All you need to do is that should your management ever require your password, change the password and hand in a new envelope. You might want to change your password in regular intervals anyway: It's common best practice.

By the way: In companies with a proper IT management this method is unnecessary, because system administrators can receive any necessary information from user accounts without having to know the passwords of the user. If an administrator really needs to log into a user account, they would reset the password (which would create a verifiable audit trail). And there is usually more than one system administrator, so the admin accounts do not require this method either.

share|improve this answer
7  
The last paragraph is not 100% correct, cf superuser.com/questions/767239/… – Hagen von Eitzen Jan 31 at 20:53
13  
"they would reset the password" ... or just use something like sudo & co. – Bakuriu Jan 31 at 21:03
20  
One thing I would add is that there needs to be company knowledge (and ideally oversight) of this escrowed password process. If the boss can simply respond with "What do you mean signed envelope? We don't do that here." Or "I asked him for his password but he never provided the envelope" then the other preparations don't offer much protection against your account being misused by the boss. – PwdRsch Feb 1 at 2:34
11  
I would change It's common best practice to It's common practice. While many organisations promote changing passwords frequently, I have never seen a convincing argument for doing so and many arguments against. – CJ Dennis Feb 1 at 3:29
6  
@PwdRsch: So, get the boss to give you a receipt for the password envelope. – Nate Eldredge Feb 1 at 3:40

I don't think you are in a particularly worse situation than not disclosing your password. Your boss could:

  • Get the system administrator to make a copy of your (hashed) current password
  • Change it to something new
  • Do something evil in your name
  • Put the old password back (replace the hash back what it was)

What does protect you is that there are, presumably, audit trails of things that are done. For example, tracking emails by IP addresses.

If anything you are in a better situation than before. Now you can plausibly argue, if something bad is done in your name: "But my boss insisted on having my password, maybe he did it".

If the audit trails can be used to prove your boss's innocence in this sort of situation, then it can also be used to prove yours. And if no audit trails exist there will be doubt as to who really did it - whatever "it" is.

share|improve this answer

Change your password immediately after handing him the envelope.

You have fulfilled his requirement of giving him an envelope with your password, and you have fulfilled the need to keep it secure. In the unlikely event that he tries to use the envelope password, you can explain that you needed to change it and he had yet to receive the new envelope.

In no case would I trust anyone with a password of mine, even in a sealed envelope. An envelope is too easy to breach, even without breaking the seal. Even using "security envelopes", placing a bright light (super flashlight, office projector, car headlight) to the back side of it will cause the contents to be able to be seen through it. Considering the information to be obtained is likely a large printed single word, it is not secure. I have never worked for a company that has asked for me to give them a password in an envelope.

share|improve this answer
28  
This is a breach of trust. While the OP's company doesn't appear to have a correctly-managed IT infrastructure, that doesn't mean you should go out of your way to screw your employer who expects this information. Besides, you should always assume your employer has access to everything you're doing online. Just don't use the same password at work that you use elsewhere... problem solved. – Mark Buffalo Feb 1 at 14:10
6  
In practice, I'm not sure any of this matters. It's a password to a company-owned user account on company-owned equipment. As others have said, I'm not sure what having a password to such an account gives the company that they don't already have. – Robert Harvey Feb 1 at 15:26
11  
@MarkBuffalo My trust in him is already breached when he made the false statement "this is a common practice in all companies". – Keeta Feb 1 at 15:32
1  
@Keeta Good point. I have never seen this used before. The employer could easily hardware keylog his employee and not even to ask him for the envelope. However, his employer has the right to ask such things from him. – Mark Buffalo Feb 1 at 15:33
1  
"breach of trust" LOL. It could as well be argued that the employer requesting the password under false pretenses is in itself a breach of trust. Additionally, if "you should always assume your employer has access to everything you're doing online" then the employer should not need to request the password. – user100487 Feb 2 at 14:33

Password escrow as described in your situation is highly unusual and loaded with risks. The setup you describe relies on trusting your boss to not only be honest with their intentions and motivations, it also assumes your boss is storing those passwords in a secure manner. Are the envelopes kept in a safe? A locked filing cabinet? His desk drawer? A folder on his desk?

The ideal situation:

Escrow: A system where a disinterested third party holds money/information/property in trust on the condition that certain requirements are met before transferring said holdings to the receiving parties.

In your scenario, the person holding the password is not a disinterested third party. This is less than perfect, but they are being trusted by management to be honest and secure in their handling of the passwords.

Alternatives in other answers are good suggestions. An additional alternative to the current scenario would be to split the password into multiple parts. For example, half the password given to your manager and the other half given your manager's manager(or Human Resources, or department head, or CEO, whatever makes the most sense). How to split the password and how many people have access to which portions of the password will vary depending on the company management structure.

Just as they're trying to mitigate risk by having password escrow in the first place, they should avoid having a single point of failure in the process. Avoiding conflicts of interest and requiring multiple parties to be involved would go a long way to making password escrow safer. It's still not a great management practice, but it doesn't have to be as insecure and risky as just handing the password over to the boss in a plain envelope. Even something as simple and cheap as adding tamper resistant security tape would improve the current scenario.

share|improve this answer

Philipp is correct here. Let me restate something he said:

In order to use your password, one needs to break the seal of the envelope you signed. When you think your password was abused, you can ask to see the envelope with your signature and check if it is still unopened.

To add to what he's saying, your company appears to have grossly incorrect IT management practices. What you should do at this point is make sure your password is not the same as the one you use elsewhere.

Always assume your employer has access to whatever you're doing online. Even if they don't. Do not log into your social networking accounts at work. Do not log onto your bank accounts. Use your work computer for work-related tasks. If you have a cell phone, it's even easier.

Your employer should be able to do whatever they want, within the confines of the law, to your work computer. You should not have any expectation of privacy.

share|improve this answer
2  
Signing it is not foolproof. What if the boss steams it open and then reseals it? What if he takes a high resolution photo of the signature and practices forging it himself hundreds of times until he can do it perfectly? – Buttle Butkus Feb 2 at 9:50
2  
@ButtleButkus Then you might have a problem with tinfoil hattery. I'm not discounting your concerns, but you need to prioritize risks. – Mark Buffalo Feb 2 at 12:32
1  
my point is that this security system is not at all foolproof. If the OP has a real concern about being framed for malfeasance, then the sealed envelope trick should definitely not assuage his fears. – Buttle Butkus Feb 3 at 2:14
    
Nothing is fool-proof. ;-) You can only manage risks. – Mark Buffalo Feb 3 at 2:15
4  
Certainly, but using 19th century security-by-obscurity methods in the year 2016 is pretty amusing. – Buttle Butkus Feb 3 at 2:23

This should be completely unnecessary in a properly configured system, assuming you log on to a corporate domain. In a properly configured system, logging on to a corporate domain, any data you edit, create or have access to on the network or on your local system, will be stored in a location accessible by others who each have their own login credentials which will have the necessary permissions to access that data. By using their own login credentials, they not only have access to network data, but also local data and the audit logs will show who did what and when. Be REQUIRED to give your username and password to ANYONE is not only a bad practice, but is highly irregular, risky and/or indicative of incompetent system/network administration.

If I were in your shoes, I would ask his superiors about that policy, change my password and refuse. If your job is threatened, then I would call their/his/her bluff and prepare to file suit for wrongful termination if you do get fired. I personally, would never give that info away nor would I trust a sealed envelope as the security measure to keep people honest (sealed envelopes can be opened and resealed, if you know how or a new envelope sealed with a forged signature.) Even the seemingly nicest of bosses could simply be putting on an act until they turn on you and frame you for something. I witnessed something similar, except instead of a sealed envelope containing a password, it was a disk containing a backup copy of encryption keys. The fallout wasn't pretty and the manager got fired after the discs and data was stolen. Unsurprisingly, the fired manager never got another job, never had money problems and a competitor came to market first with the very project we had been working on. Prior to the theft, our competitor didn't even have a similar product. Be careful and think about my advice. That sounds very suspicious to me and so often in these times, the friendliest/nicest people turn out to be the most venomous snakes.

share|improve this answer

This is unfortunately common in small companies using cloud services, without having a business relationship with the cloud provider.

Mark the envelope to make it a bit more tamper proof, that's it. A former company of mine still uses my personal e-Mail address in their domain, the never managed to change their domain registration after I left.

Change the password frequently, and hand in new envelopes every time. They would need to produce all old envelopes too, so they can proof they haven't opened one. Since most online services won't provide audit trail. So you can always stand upright innocent.

share|improve this answer

Let's call it what it is: a workaround for lack of proper access control. The real solution is to fix/improve access control.

Specifically, here: Why can't your boss access the things you can access with his own account?

The only purpose of credentials is to authenticate an identity. If we break that, they become useless. You might as well remove the concept of an "account" and use shared secrets for everything.

So as an alternative to outright refusing, attempting to convince him to tackle the root issue (which probably appeared because of a misunderstanding) might be worthwhile. If argued right, this shouldn't create friction: the ultimate result is a safer system for everyone.

share|improve this answer

Never had to me in any company I was in.

In such case, I would put in the envelope a message saying "In case of emergency call me on mobile mobile number".

In case of emergency, I can spell the password over the phone and be informed that it was used - and my boss could do anything needed. So it is all he needs.

If the envelope is misused/stolen/scanned/broken - it would not let anyone impersonate me.

share|improve this answer
    
What if the emergency is death? How do you answer the call then? – 200_success Feb 4 at 0:33
    
Then the password would be found in envelope with name of my boss/company in the box with other documents like mariage-certificate, lend-a-house and such (as I do not want to forgot it, I need to have it written somewhere). (usuall bills for gas, electricity etc are in other box) - death is so special case, that having to ask my wife to open the envelope is not way off – gilhad Feb 4 at 9:32

It's a big lie - no one needs your pass to access your account, there are an administrative accounts just to fit this purpose. Even more - it's not a common practice except for cheaters wishing to blame you and reduce/remove your payroll. Neither your pass, nor your certificate(s) are required for an Administrator to take a look at your full account.

share|improve this answer

If you're worried about your boss opening the envelope, using your password for deeds of nefarious do, and then resealing your password in a new envelope and forging your signature, then just splatter a bit of paint, Jackson Pollock style, on the envelope after you sign right across the glued area, and then take a few very high resolution photos of the envelope to easily identify any attempted Pollock forgeries. Just be sure to also protect the password from any visible, infrared, x-ray, gamma ray, or any other form of peeping radiation that may allow your boss to read your password without opening the envelope, by enclosing your password in a thick lead case before putting it into the envelope.

Of course, you will also have to worry that the had a camera recording you as you wrote the password down in the first place. In that case, make sure you've done all of that at home and that he has never had access to your home.

I think that covers it.

EDIT:

Except of course if your boss rips the envelope open, performs the nefarious deeds, and then starts a severe toaster fire in the snack room next room on the same day that the security cameras are being repaired and are offline, thereby burning up all the password envelopes and absolving himself of any suspicion. So I suggest you spray down the entire room and neighboring rooms with a flame retardant foam. That should solve your problem.

share|improve this answer

The very existence of the envelop protects you from any nefarious doings by your boss. In general, you don't need to prove your innocence. Someone else needs to prove your guilt. And that is going to be quite hard if it is well known that someone else has access to the incriminating account. If you are really worried about it, just sign the envelope wonky. Then, if your boss does manage to read the password through the envelope to do something nefarious, you can refute the validity of the envelope itself.

Side notes:

  1. This is not common practice in any large company, but I can see how it would make sense to someone trying to run a small company. In fact, I have heard of several small companies that ran into trouble when a key resource left without disclosing the passwords to various software.
  2. If you ever want to commit a crime using your account, be sure lots of other people have access to your password first.
share|improve this answer

This actually depends on both country and/or state laws that you live. This is more of a question for employment law, than it is a cyber security question.

The reason that this is an employment law question is that it depends on the size of the organization, the data and system in question, the general employment contract, and the company policies.

Companies can and do put write this into employment contracts. Generally, your employee handbook will explain what data, or information systems belong to them, or have clauses in their general company policy that describe what information systems belong to them. If they own the system in question depending on what the system is being used for, they not only have the right to your password, they are legally allowed to do whatever they want with your password, the data involved with the system, and anything in between all in accordance with both the federal, state, and local laws within your jurisdiction.

This is why companies can enforce the use of proxies in order to record information. However, if the system in question is not owned by their organization and you are using their network, then it becomes a grey area because of privacy laws.

The only way to prevent this is the following:

1) In short, you as an employee, can not prevent this, if they own the information/data and the system of which you have access to.

2) Read your employee handbook, your employment contract, and specifically ask what information and data are specifically owned by the company. This includes everything from your ideas, your invention assignment agreement, and any personal information that you consider private.

3) Separate personal use from corporate use, If the company provides you with a laptop, or information system for you to use, do not use it for personal use. This is the area that becomes grey. For instance, if you published corporate secrets on facebook whether its on your personal computer or theirs they may still own the data.

share|improve this answer
    
Information security is about more than just computer related topics. I feel the question meets all four bullet points listed in the help center for the What background should I give in my question? section of what's on topic. – Booga Roo Feb 14 at 5:32

I would say this is typical, and used fairly commonly in the industry. Not the exact same way though.

Many companies use password managers where the they can access employees passwords, and passwords can be shared between employees. This is mostly for logging into 3rd party services that don't support individual user accounts.

This would specifically only be for company related logins though. No personal logins should have this.

share|improve this answer

protected by Rory Alsop Feb 3 at 23:22

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.