Company sending Master passwords in unencrypted emails

Question

If a company has terrible security policies like letting people email password in cleartext emails, what to do if they reject all fair minded advice?

Answer 1

Ridiculing them in a public fashion isn't necessarily the best approach.

What can be done to help people who do inadvisable things but refuse fair minded advice?

Nothing.

You can show them the risks of what they are doing. You can calculate the cost of breaches because of these risks. You also have to compare them to the liklihood of a breach actually occurring. If they do nothing when you say it's going to cost $10,000 to recover from a breach that has a 67% chance of happening in the next six months, but it's only going to cost $2000 now to prevent it, there is really nothing you can do about it.

After a breach occurs they'll probably come back to you and ask to reevaluate their options, but that's an entirely different problem.

Answer 2

1) Find another company to do business with

2) Tweet about them to bring some public pressure to mend their ways

3) Use a totally random, completely unique password. You could use something like LastPass to generate one, although for what it's worth, you should bump the default length to 12 characters, not 8.