Timeline for Convince people not to share their password with trusted others
Current License: CC BY-SA 3.0
18 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 24, 2016 at 6:54 | comment | added | Peter - Reinstate Monica | @michael Is the NSA "decent sized" enough? (And paranoid enough about security, and resourceful enough?) | |
| Oct 24, 2016 at 5:57 | comment | added | michael | Unless you're working at a small startup, no decent sized company grants unrestricted and unlogged access to an employee. I'm not debating whether or not having root on a server or database could get around needing someone's password, my point is if you work for a company where anyone in IT can spoof you without a trace, wow. There are rarely, if ever, times where having the user tell you their password is necessary. If you think it's necessary, I'd highly question you being an "IT professional". | |
| Oct 24, 2016 at 5:50 | comment | added | michael | @DarrenH I've worked in IT, email servers, and databases, so if anyone doesn't have any idea how they work; you clearly have no idea how to set one up securely. And you're right, the question was about family members, but I was specifically responding to "Disclosing passwords to IT professionals falls in the same category as disclosing your earnings to your tax adviser or your health issues to your doctor." If a family member or friend is coming to you, they're coming to you as a family or friend who is tech savy, not an "IT professional". | |
| Oct 1, 2016 at 11:46 | history | bounty ended | Auzias | ||
| Oct 1, 2016 at 9:55 | comment | added | transistor09 | I wholeheartedly disagree. Having access to the same resources should not be equated to breaching the identity promise that passwords provide. It's your password that identifies you, if someone else changes something, their name should appear in the log. | |
| Oct 1, 2016 at 9:23 | comment | added | Darren H | @michael I conclude from your comment you do not work in IT or have a good understanding of mail servers or databases work | |
| Sep 30, 2016 at 7:02 | comment | added | Peter - Reinstate Monica | @michael So, no, Mark Zuckerberg doesn't need your password to change your Facebook account settings, and Joel doesn't need your SO password to change or delete your account or read your deleted posts here. If you don't like that, don't use Facebook or SO. I, on the other hand, do need your password for that because I don't run those servers. | |
| Sep 30, 2016 at 6:57 | comment | added | Peter - Reinstate Monica | @michael Re "If I worked...": Does "Snowden" ring a bell? You have never been root on a mail or web server? Or only on one where the disks and all traffic were encrypted? Even if -- the admin usually can reset people's passwords (even if he can't retrieve them) and thus reset them temporarily, and then set them back. Whatever. It's hard to prevent root from spying. (It is true though that corporate IT usually doesn't need a password -- but that is because they are running the frigging servers!) And besides, the question was about family members, not secure corporate installations. | |
| Sep 30, 2016 at 6:09 | comment | added | michael | I highly disagree with this but I suppose it depends on the company. For most companies I've worked for, if someone from IT requested another employee's password, they'd be reported. If I worked for a company where IT had access to my emails, files, or password, I would quit the first day, and I can't imagine many companies allowing IT unrestricted access like you seem to describe. Either they have access but everything is explicitly logged in detail or they do not have access and would have the employee log in and oversee it in person. | |
| Sep 30, 2016 at 2:56 | comment | added | Criticizing Israel not allowed | @Izkata Yeah, there should, but usually, there isn't. | |
| Sep 29, 2016 at 21:03 | comment | added | Izkata | @PeterA.Schneider There should still be a way to do that without having to use that user's personal password. Our system calls it masquerading. | |
| Sep 29, 2016 at 10:07 | comment | added | Peter - Reinstate Monica | @jpmc26 I see your point and partly agree. But I think that some IT assistance is easier delivered when the IT person can just log on to the user's account and do stuff (web mail setup, server configuration, even online banking ...). Many examples in other answers involve the user logging on and the IT person then using that session, but that's hard or impossible remotely. And my general idea holds here as well: If you have bad judgement in whom to trust, you are in trouble anyway. | |
| Sep 29, 2016 at 9:56 | comment | added | eirikdaude | @jpmc26 You should make that an answer, it is the best reason not to share passwords I've seen on this page so far. | |
| Sep 28, 2016 at 17:42 | comment | added | jpmc26 | I +1ed this, but I agree with the OP's premise that they shouldn't give IT people passwords. The reason is that being in the habit of sharing passwords provides a new threat vector: the user now has to distinguish between legitimate IT professionals and illegitimate ones. By making it clear that IT professionals do not need your password, they train the user to be alarmed if someone ever asks for it. This is a good thing, and I think it is professionally unethical to shirk the responsibility of training people in good habits. | |
| Sep 27, 2016 at 10:38 | comment | added | Peter - Reinstate Monica | @topher The question starts with "IT workers are usually trusted by their family members..." and concludes asking "What list of arguments ... do you use ...". What to do in the general case is a wide field where parts of my argument may or may not apply... Passwords are, generally spoken, not different from other sensitive data which can be abused, and should be handled with comparable care. Not more, and not less. Like, do you give family members the keys to your house? Your car? Your credit card? Would you accept any of those? | |
| Sep 27, 2016 at 10:09 | comment | added | topher | The "trusted people" can apply to people who are not the OP, and not IT professionals. What then? | |
| Sep 27, 2016 at 9:45 | history | edited | Peter - Reinstate Monica | CC BY-SA 3.0 |
added 383 characters in body
|
| Sep 27, 2016 at 9:23 | history | answered | Peter - Reinstate Monica | CC BY-SA 3.0 |