Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm working in a small company (20 employees) as a senior software engineer.

After having problems with my email, our newly employed IT administrator asked me to write my user password to someone in our hosting company to help them identify the problem.

Without any thought I gave him my user password.

After 30 minutes, I realized that in my 10 years of working in several companies nobody asked me for a password, and I found it rather strange. Immediately after that, I changed my password.

Are there cases where the password is really needed, when I really have to tell my password to an IT administrator?

I have heard of stories where admins asked for the user's password, but only on sites like The Daily WTF, which prompted this question.

(Related: "A client wants to tell me his home laptop's password. Must I push him towards a more-complex alternative?")

share|improve this question
2  
The other version of this question was closed because the answers where not focused on security. My answer focused on the practical point. In the real world there are crappy external services that provide no way for a local support person to help. If you want help from your local guy, then you may have no choice. You can change the password on your account before and/or after, or you can deal with the problem yourself. –  Zoredache Jul 22 '11 at 0:21
    
@Zoredache, Reading your updated answer there now, specifically the last paragraph, that does change it a bit - but see my comment below, about how "shared" accounts are really not a good idea. Besides, the OP did say "my password", so it seems thats not the case - but I'm sure VJo could clarify that. –  AviD Jul 22 '11 at 0:31
    
Sadly, this happened to me. But the Admin was the owner of the company. What can you do? –  LarsTech Jul 22 '11 at 3:51
    
@AviD Right. The account is not shared. –  BЈовић Jul 22 '11 at 7:52
9  
"my password" and "the password to our hosting company" are two completely different things. The former the admin has no business with, the latter may very well be required for him to do his job! –  Michael Kjörling Jul 22 '11 at 11:00

7 Answers 7

up vote 61 down vote accepted

Short answer:

ABSOLUTELY NOT!
Your password is between you, and your computer alone.
No one else.

Not your boss, his boss, the system administrator, your bank official, your insurance agent, your ISP support technician, or your cat. Well, your cat you can tell, if she promises not to share it.

There is NEVER a good reason to share a password.
There are many reasons NOT to. Mostly, because a password is YOUR authentication, and as soon as even ONE other person knows it, it can no longer prove your identity.

Any reason your admin comes up with, is bogus, either because he is malicious, lazy, misinformed, or incompetent.
That said, it may not be his fault, but the fault of his organization. Either way, there is incompetence, ignorance and laziness abound.

If an admin, or ANY support technician asks for your password, the correct response is to LAUGH.
Because there's no way they're serious, right?

If your admin insists - explain to him that you will document sharing your password with him... and that, based on this, you are going to send nasty emails to all around - not about him, but you will claim that they came from him (using your account, in your name, using your password that you just shared with him). Of course he won't be able to prove that he didn't misuse your password... which is the point.

No, on second thought, just don't give him your password. It's yours, between you and the computer alone.

share|improve this answer
5  
I will also note, that you shouldn't type your password on his computer, unless you explicitly trust THIS PERSON. And he shouldn't ask - it's bad user education, training users to type their passwords on any random machine - that may have keyloggers, traffic sniffers, etc. –  AviD Jul 21 '11 at 20:54
5  
Someone likes to use CAPSLOCK to MAKE THEIR POINT. –  k to the z Jul 21 '11 at 20:57
29  
Shift, actually. Used selectively, it is a useful tool for emphasis. –  AviD Jul 21 '11 at 21:06
3  
Btw, @Zoredache, one "exception" to the above comment, is if the credentials are not for his personal account, rather a "company", shared account. (I think this may be what you were getting at...?) In that case, of course they shouldnt be hoarded, and given to whomsoever is responsible for administration. Very bad practice, forbidden by many regulations, but not as bad as giving up the password keys to your own identity kingdom. –  AviD Jul 22 '11 at 0:26
7  
Do NOT tell your password to your cat. Cats are not to be trusted under any circumstances. As innocent as they may appear, they have been known to be malicious. –  paraxor Jun 22 '13 at 0:56

If the admin is trying to diagnose a problem only you are having, there might be good reason to access your account "as you" to identify your problem efficiently. You have a lot higher probability of getting your problem fixed if you make it easy for them.

Consider, that your data is not really secret from the sysadmins, so the only thing you're actually protecting is the password itself. If you're already following good password hygiene, it has no value as long as you change it again as soon as they are done.

The alternative - that they have a back door to bypass the need for passwords, is not really attractive either.

share|improve this answer
    
But the data can be made secret by encryption, no? I am not sure what you mean with "back door". Officially, there are no back doors in linux ;) –  BЈовић Jul 10 '13 at 5:59
    
This is about a service account and incoming email. There's no separate encryption (or if there were, the user password would be irrelevant.) As root in unix, I can change your password and log in as you. How's that for a back door? –  ddyer Jul 10 '13 at 18:03
    
@ddyer: What's a service account? –  unforgettableid Jul 14 '13 at 17:29
1  
-1. AviD has pointed out that if the sysadmin resets your password, it creates an audit trail, whereas if you change it for the sysadmin, there's no audit trail. Don't share your password: instead, ask your sysadmin to reset it then to diagnose the problem. –  unforgettableid Jul 14 '13 at 17:33

Short answer, if he is an admin he should never need your password. The worst case scenario is that he needs to resets your password and give you a new one (which you would promptly change).

Unless there is some mitigating circumstances, passwords/codes/phrases are for you alone. (e.i. if the admin doesn't have a privileged account on your PC)

I have entered a few jobs where a long-time employee will have a one-off machine that doesn't have an admin account that i can use on it, but even then it's a better solution to have the user (assuming they have the rights to) make the admin a privileged account that they can use. So even then i'm hard pressed to think of any viable reason why the admin would need your password. It's always a sad day to learn that the user doesn't have administrative rights, it's not connected to the domain, and the admin that set it up hasn't worked there for 10 years......

p.s. as said in another answer, it is possible that the admin is used to getting the "get it done" treatment from their superiors, which may result in them just asking for passwords.

share|improve this answer
3  
p.s. if the password is the administrator level password or a password to an external service that the admin does need access to, he does need the password (or needs an administrative level account created for him on that service). My response was from the perspective that it was your password. If it's for a company service, i.e. the company's web-host, it's not "your" password. Even then, it's preferred that each individual has separate logins (for accountability/auditing purposes). –  Ormis Jul 25 '11 at 18:15

There is also one other problem with password sharing.

If anything happens to your account or by your account while someone else is logged you are the one who will be blamed. Even if inside the company is ok to share password by security policy, legaly (by law; at least in my country) you are the one who will be accused.

share|improve this answer
1  
That's interesting; I'm not familiar with local laws there, but in most places, being able to prove that someone else had your password (either stolen, or given in a "legitimate" way) can cause serious repudation issues, i.e. absolve you (-ish) of responsibility). –  AviD Jul 22 '11 at 8:12
    
I know one girl few years ago gave her mail account to her boyfriend who then sent some blackmailing mails. She was found guilty, despite proving mails were not sent by her. EDIT: Well, anyway, even if you can prove it wasn't you and by laws you won't be found guilty, it's still unpleasant situation, don't you agree? –  StupidOne Jul 22 '11 at 8:16
    
Absolutely, I agree with that point completely. –  AviD Jul 22 '11 at 8:28
1  
Look at an y Term of Services for a service and you will confirmed that password is your sole responsibility. –  M'vy Jul 22 '11 at 8:54
    
@Mvy, of course. But what happens when you can prove that someone else has it? Is it your fault and you bear responsibility? Or repudiation? –  AviD Jul 22 '11 at 9:04

It may be time to dig out your IT security policy. If you have one in your organisation. If not, time to get the team to sit down and pen one.

It may be the case that this admin has not read it or been trained.

A culture of giving out passwords will certainly increase the chances of accounts being comprised if there are not checks in place to verify each and every request.

The issues raised about accountability are also a bit of a concern.

It's not good practice for sure.

share|improve this answer

It was explained before that nobody should ever give its password to an administrator (i'm ok with all of it), but you should check with his superior what's going on, because if he asked yours, it's possible that he asked the password of the 18 others ( the 19th is probably his superior) and i'm pretty sure that some of your fellow co-workers use the same password everywhere.

share|improve this answer
    
+1 good point. Check with supervisor, or with policy, to see if the admin should be asking. –  Rory Alsop Jul 22 '11 at 9:50
3  
And, if so, probably go and have those policies updated... –  AviD Jul 22 '11 at 11:08

Let's try another idea: would you give one of your finger to your IT manager so that he can repair your access to your building while you are working?

I'll assume the answer is no. The same applies to your password. Even if you have a single password for all your services (Which never happens, even for me I confess) the password should NEVER EVER shared with anyone. It's is the only thing that can authenticate yourself. That can bother you having to waste time with your IT support, but this can also send you to jail for a long time.

So, definitely: no

share|improve this answer
5  
Giving a finger is a needlessly over-exaggerated isn't it? After all you can simply change the password after the IT guy is done with the work, changing your finger isn't possible. –  Zoredache Jul 21 '11 at 23:56
5  
No, it is not exaggerated. Once an account is owned, it is owned - For example, depending on what the service is, and what functionality is present, a user may be able to create a surrogate account (e.g. a forwarding email address, a secondary admin account, etc). Granting someone else "temporary" access to your identity is usually no such thing. –  AviD Jul 22 '11 at 0:21
7  
I might give him the finger, though ;) –  Piskvor Jul 22 '11 at 10:07
    
@AviD: The problem there is that effectively a sysadmin is God. They can always take over your account. At the local level they can just use su for Unix-syle systems, or for Windows they create a token with the zwCreateToken call. For both local and network credentials they can almost always change your password (although many systems make it very hard for them to change the password back). –  Kevin Cathcart Jul 22 '11 at 19:58
3  
@Kevin, but thats not the same thing as "borrowing" your password... If the admin resets or takes over your account, there is auditing. Also, dont forget things like e.g. EFS, where changing a user's password still does not give you access. The problem is this mindset that effectively a sysadmin is God - this is not true, nor should it be the case: God does not have to justify his actions, a sysadmin does. –  AviD Jul 23 '11 at 21:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.