2 added 26 characters in body
source | link

Another angle except for the obvious (which you know already, as you show in the question - storing unencrypted passwords is bad):

Not sharing/giving out/writing down passwords is or should be one of the first bullet point in any security guideline. No sane bank, online service or whatever entity will ever ask for a password. This is ingratiatedingrained in every user, for good reasons.

If I were your client, and your emplyeremployer asked me for a password, I'd a) not give it to you and b) be running to my management pretty quickly. I would very much try to make sure that we were not your client anytime longer.

I do not even give my password to my own support guys (in the unlikely case that they need me to log in for methem during a support session I will do so myself). I have been on the receiving end of security checks (for systems and/or applications) and never has any actual user account been passed to the servicesecurity company. If they need to log in, they are getting their own temporary accounts. I had customers try to tell me their password, and I make pretty sure to interrupt them right away and have them type it in themselves.

TL;DR: Feel free to show your management this answer - I would be one customer lost to you.

Another angle except for the obvious (which you know already, as you show in the question):

Not sharing/giving out/writing down passwords is or should be one of the first bullet point in any security guideline. No sane bank, online service or whatever entity will ever ask for a password. This is ingratiated in every user, for good reasons.

If I were your client, and your emplyer asked me for a password, I'd a) not give it to you and b) be running to my management pretty quickly. I would very much try to make sure that we were not your client anytime longer.

I do not even give my password to my own support guys (in the unlikely case that they need me to log in for me during a support session I will do so myself). I have been on the receiving end of security checks (for systems and/or applications) and never has any actual user account been passed to the service company. If they need to log in, they are getting their own temporary accounts. I had customers try to tell me their password, and I make pretty sure to interrupt them right away and have them type it in themselves.

TL;DR: Feel free to show your management this answer - I would be one customer lost to you.

Another angle except for the obvious (which you know already, as you show in the question - storing unencrypted passwords is bad):

Not sharing/giving out passwords is or should be one of the first bullet point in any security guideline. No sane bank, online service or whatever entity will ever ask for a password. This is ingrained in every user, for good reasons.

If I were your client, and your employer asked me for a password, I'd a) not give it to you and b) be running to my management pretty quickly. I would very much try to make sure that we were not your client anytime longer.

I do not even give my password to my own support guys (in the unlikely case that they need me to log in for them during a support session I will do so myself). I have been on the receiving end of security checks (for systems and/or applications) and never has any actual user account been passed to the security company. If they need to log in, they are getting their own temporary accounts. I had customers try to tell me their password, and I make pretty sure to interrupt them right away and have them type it in themselves.

TL;DR: Feel free to show your management this answer - I would be one customer lost to you.

1
source | link

Another angle except for the obvious (which you know already, as you show in the question):

Not sharing/giving out/writing down passwords is or should be one of the first bullet point in any security guideline. No sane bank, online service or whatever entity will ever ask for a password. This is ingratiated in every user, for good reasons.

If I were your client, and your emplyer asked me for a password, I'd a) not give it to you and b) be running to my management pretty quickly. I would very much try to make sure that we were not your client anytime longer.

I do not even give my password to my own support guys (in the unlikely case that they need me to log in for me during a support session I will do so myself). I have been on the receiving end of security checks (for systems and/or applications) and never has any actual user account been passed to the service company. If they need to log in, they are getting their own temporary accounts. I had customers try to tell me their password, and I make pretty sure to interrupt them right away and have them type it in themselves.

TL;DR: Feel free to show your management this answer - I would be one customer lost to you.