Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 24 down vote favorite
2

I'm working in a small company (20 employees) as a senior software engineer.

After some email problems, our newly employed IT administrator asked me for the password to our hosting company to see why exactly.

Without any thought I gave him my password.

After 30 minutes, I realized that in my 10 years of working in several companies nobody asked me for a password, and I found it rather strange. Immediately after that, I changed my password.

Are there cases where the password is really needed, when I really have to tell my password to an IT administrator?

I have heard of stories where admins asked for the user's password, but only on sites like The Daily WTF, which prompted this question.

share|improve this question
2  
The other version of this question was closed because the answers where not focused on security. My answer focused on the practical point. In the real world there are crappy external services that provide no way for a local support person to help. If you want help from your local guy, then you may have no choice. You can change the password on your account before and/or after, or you can deal with the problem yourself. – Zoredache Jul 22 '11 at 0:21
@Zoredache, Reading your updated answer there now, specifically the last paragraph, that does change it a bit - but see my comment below, about how "shared" accounts are really not a good idea. Besides, the OP did say "my password", so it seems thats not the case - but I'm sure VJo could clarify that. – AviD♦ Jul 22 '11 at 0:31
Sadly, this happened to me. But the Admin was the owner of the company. What can you do? – LarsTech Jul 22 '11 at 3:51
@AviD Right. The account is not shared. – BЈовић Jul 22 '11 at 7:52
3  
"my password" and "the password to our hosting company" are two completely different things. The former the admin has no business with, the latter may very well be required for him to do his job! – Michael Kjörling Jul 22 '11 at 11:00
show 1 more comment

6 Answers

up vote 32 down vote accepted

Short answer:

ABSOLUTELY NOT!
Your password is between you, and your computer alone.
No one else.

Not your boss, his boss, the system administrator, your bank official, your insurance agent, your ISP support technician, or your cat. Well, your cat you can tell, if she promises not to share it.

There is NEVER a good reason to share a password.
There are many reasons NOT to. Mostly, because a password is YOUR authentication, and as soon as even ONE other person knows it, it can no longer prove your identity.

Any reason your admin comes up with, is bogus, either because he is malicious, lazy, misinformed, or incompetent.
That said, it may not be his fault, but the fault of his organization. Either way, there is incompetence, ignorance and laziness abound.

If an admin, or ANY support technician asks for your password, the correct response is to LAUGH.
Because there's no way they're serious, right?

If your admin insists - explain to him that you will document sharing your password with him... and that, based on this, you are going to send nasty emails to all around - not about him, but you will claim that they came from him (using your account, in your name, using your password that you just shared with him). Of course he won't be able to prove that he didn't misuse your password... which is the point.

No, on second thought, just don't give him your password. It's yours, between you and the computer alone.

share|improve this answer
2  
I will also note, that you shouldn't type your password on his computer, unless you explicitly trust THIS PERSON. And he shouldn't ask - it's bad user education, training users to type their passwords on any random machine - that may have keyloggers, traffic sniffers, etc. – AviD♦ Jul 21 '11 at 20:54
3  
Someone likes to use CAPSLOCK to MAKE THEIR POINT. – k to the z Jul 21 '11 at 20:57
11  
Shift, actually. Used selectively, it is a useful tool for emphasis. – AviD♦ Jul 21 '11 at 21:06
1  
@Zoredache, If the admin should have access to this service, he should have his own credentials. If he does not, then he shouldn't. Note that (owning) credentials are pretty much equivalent to (owning) an identity - and that should not be shared. The nasty emails weren't supposed to be sent, rather to show the problem with sharing a password; same with the laughter, since with an honest, competent sysadmin that would only be said as a joke. (And btw, from my experience its the security guys with access to the real bofh stuff... ;) ) – AviD♦ Jul 22 '11 at 0:25
2  
Btw, @Zoredache, one "exception" to the above comment, is if the credentials are not for his personal account, rather a "company", shared account. (I think this may be what you were getting at...?) In that case, of course they shouldnt be hoarded, and given to whomsoever is responsible for administration. Very bad practice, forbidden by many regulations, but not as bad as giving up the password keys to your own identity kingdom. – AviD♦ Jul 22 '11 at 0:26
show 3 more comments
up vote 13 down vote

Let's try another idea: would you give one of your finger to your IT manager so that he can repair your access to your building while you are working?

I'll assume the answer is no. The same applies to your password. Even if you have a single password for all your services (Which never happens, even for me I confess) the password should NEVER EVER shared with anyone. It's is the only thing that can authenticate yourself. That can bother you having to waste time with your IT support, but this can also send you to jail for a long time.

So, definitely: no

share|improve this answer
1  
Giving a finger is a needlessly over-exaggerated isn't it? After all you can simply change the password after the IT guy is done with the work, changing your finger isn't possible. – Zoredache Jul 21 '11 at 23:56
3  
No, it is not exaggerated. Once an account is owned, it is owned - For example, depending on what the service is, and what functionality is present, a user may be able to create a surrogate account (e.g. a forwarding email address, a secondary admin account, etc). Granting someone else "temporary" access to your identity is usually no such thing. – AviD♦ Jul 22 '11 at 0:21
6  
I might give him the finger, though ;) – Piskvor Jul 22 '11 at 10:07
@AviD: The problem there is that effectively a sysadmin is God. They can always take over your account. At the local level they can just use su for Unix-syle systems, or for Windows they create a token with the zwCreateToken call. For both local and network credentials they can almost always change your password (although many systems make it very hard for them to change the password back). – Kevin Cathcart Jul 22 '11 at 19:58
Strange use of anecdote you got there...but also, using your finger as a password, is pretty much the same of leaving your password on post-its everywhere you go. – Dog eat cat world Jul 22 '11 at 22:47
show 4 more comments
up vote 8 down vote

It was explained before that nobody should ever give its password to an administrator (i'm ok with all of it), but you should check with his superior what's going on, because if he asked yours, it's possible that he asked the password of the 18 others ( the 19th is probably his superior) and i'm pretty sure that some of your fellow co-workers use the same password everywhere.

share|improve this answer
+1 good point. Check with supervisor, or with policy, to see if the admin should be asking. – Rory Alsop♦ Jul 22 '11 at 9:50
2  
And, if so, probably go and have those policies updated... – AviD♦ Jul 22 '11 at 11:08
up vote 5 down vote

It may be time to dig out your IT security policy. If you have one in your organisation. If not, time to get the team to sit down and pen one.

It may be the case that this admin has not read it or been trained.

A culture of giving out passwords will certainly increase the chances of accounts being comprised if there are not checks in place to verify each and every request.

The issues raised about accountability are also a bit of a concern.

It's not good practice for sure.

share|improve this answer
up vote 4 down vote

There is also one other problem with password sharing.

If anything happens to your account or by your account while someone else is logged you are the one who will be blamed. Even if inside the company is ok to share password by security policy, legaly (by law; at least in my country) you are the one who will be accused.

share|improve this answer
1  
That's interesting; I'm not familiar with local laws there, but in most places, being able to prove that someone else had your password (either stolen, or given in a "legitimate" way) can cause serious repudation issues, i.e. absolve you (-ish) of responsibility). – AviD♦ Jul 22 '11 at 8:12
I know one girl few years ago gave her mail account to her boyfriend who then sent some blackmailing mails. She was found guilty, despite proving mails were not sent by her. EDIT: Well, anyway, even if you can prove it wasn't you and by laws you won't be found guilty, it's still unpleasant situation, don't you agree? – StupidOne Jul 22 '11 at 8:16
Absolutely, I agree with that point completely. – AviD♦ Jul 22 '11 at 8:28
1  
Look at an y Term of Services for a service and you will confirmed that password is your sole responsibility. – M'vy Jul 22 '11 at 8:54
@Mvy, of course. But what happens when you can prove that someone else has it? Is it your fault and you bear responsibility? Or repudiation? – AviD♦ Jul 22 '11 at 9:04
show 1 more comment
up vote 3 down vote

Short answer, if he is an admin he should never need your password. The worst case scenario is that he needs to resets your password and give you a new one (which you would promptly change).

Unless there is some mitigating circumstances, passwords/codes/phrases are for you alone. (e.i. if the admin doesn't have a privileged account on your PC)

I have entered a few jobs where a long-time employee will have a one-off machine that doesn't have an admin account that i can use on it, but even then it's a better solution to have the user (assuming they have the rights to) make the admin a privileged account that they can use. So even then i'm hard pressed to think of any viable reason why the admin would need your password. It's always a sad day to learn that the user doesn't have administrative rights, it's not connected to the domain, and the admin that set it up hasn't worked there for 10 years......

p.s. as said in another answer, it is possible that the admin is used to getting the "get it done" treatment from their superiors, which may result in them just asking for passwords.

share|improve this answer
2  
p.s. if the password is the administrator level password or a password to an external service that the admin does need access to, he does need the password (or needs an administrative level account created for him on that service). My response was from the perspective that it was your password. If it's for a company service, i.e. the company's web-host, it's not "your" password. Even then, it's preferred that each individual has separate logins (for accountability/auditing purposes). – Ormis Jul 25 '11 at 18:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.