81

I'm working in a small company (20 employees) as a senior software engineer.

After having problems with my email, our newly employed IT administrator asked me to write my user password to someone in our hosting company to help them identify the problem.

Without any thought I gave him my user password.

After 30 minutes, I realized that in my 10 years of working in several companies nobody asked me for a password, and I found it rather strange. Immediately after that, I changed my password.

Are there cases where the password is really needed, when I really have to tell my password to an IT administrator?

I have heard of stories where admins asked for the user's password, but only on sites like The Daily WTF, which prompted this question.

(Related: "A client wants to tell me his home laptop's password. Must I push him towards a more-complex alternative?")

Improve this question
10
  • 2
    The other version of this question was closed because the answers where not focused on security. My answer focused on the practical point. In the real world there are crappy external services that provide no way for a local support person to help. If you want help from your local guy, then you may have no choice. You can change the password on your account before and/or after, or you can deal with the problem yourself.
    – Zoredache
    Commented Jul 22, 2011 at 0:21
  • @Zoredache, Reading your updated answer there now, specifically the last paragraph, that does change it a bit - but see my comment below, about how "shared" accounts are really not a good idea. Besides, the OP did say "my password", so it seems thats not the case - but I'm sure VJo could clarify that.
    – AviD ♦
    Commented Jul 22, 2011 at 0:31
  • Sadly, this happened to me. But the Admin was the owner of the company. What can you do?
    – LarsTech
    Commented Jul 22, 2011 at 3:51
  • @AviD Right. The account is not shared.
    – BЈовић
    Commented Jul 22, 2011 at 7:52
  • 11
    "my password" and "the password to our hosting company" are two completely different things. The former the admin has no business with, the latter may very well be required for him to do his job!
    – user
    Commented Jul 22, 2011 at 11:00

9 Answers 9

Reset to default
88

Short answer:

ABSOLUTELY NOT!
Your password is between you, and your computer alone.
No one else.

Not your boss, his boss, the system administrator, your bank official, your insurance agent, your ISP support technician, or your cat. Well, your cat you can tell, if she promises not to share it.

There is NEVER a good reason to share a password.
There are many reasons NOT to. Mostly, because a password is YOUR authentication, and as soon as even ONE other person knows it, it can no longer prove your identity.

Any reason your admin comes up with, is bogus, either because he is malicious, lazy, misinformed, or incompetent.
That said, it may not be his fault, but the fault of his organization. Either way, there is incompetence, ignorance and laziness abound.

If an admin, or ANY support technician asks for your password, the correct response is to LAUGH.
Because there's no way they're serious, right?

If your admin insists - explain to him that you will document sharing your password with him... and that, based on this, you are going to send nasty emails to all around - not about him, but you will claim that they came from him (using your account, in your name, using your password that you just shared with him). Of course he won't be able to prove that he didn't misuse your password... which is the point.

No, on second thought, just don't give him your password. It's yours, between you and the computer alone.

Improve this answer
14
  • 8
    I will also note, that you shouldn't type your password on his computer, unless you explicitly trust THIS PERSON. And he shouldn't ask - it's bad user education, training users to type their passwords on any random machine - that may have keyloggers, traffic sniffers, etc.
    – AviD ♦
    Commented Jul 21, 2011 at 20:54
  • 9
    Someone likes to use CAPSLOCK to MAKE THEIR POINT.
    – k to the z
    Commented Jul 21, 2011 at 20:57
  • 55
    Shift, actually. Used selectively, it is a useful tool for emphasis.
    – AviD ♦
    Commented Jul 21, 2011 at 21:06
  • 4
    Btw, @Zoredache, one "exception" to the above comment, is if the credentials are not for his personal account, rather a "company", shared account. (I think this may be what you were getting at...?) In that case, of course they shouldnt be hoarded, and given to whomsoever is responsible for administration. Very bad practice, forbidden by many regulations, but not as bad as giving up the password keys to your own identity kingdom.
    – AviD ♦
    Commented Jul 22, 2011 at 0:26
  • 18
    Do NOT tell your password to your cat. Cats are not to be trusted under any circumstances. As innocent as they may appear, they have been known to be malicious.
    – user22208
    Commented Jun 22, 2013 at 0:56
20

Let's try another idea: would you give one of your finger to your IT manager so that he can repair your access to your building while you are working?

I'll assume the answer is no. The same applies to your password. Even if you have a single password for all your services (Which never happens, even for me I confess) the password should NEVER EVER shared with anyone. It's is the only thing that can authenticate yourself. That can bother you having to waste time with your IT support, but this can also send you to jail for a long time.

So, definitely: no

Improve this answer
11
  • 9
    Giving a finger is a needlessly over-exaggerated isn't it? After all you can simply change the password after the IT guy is done with the work, changing your finger isn't possible.
    – Zoredache
    Commented Jul 21, 2011 at 23:56
  • 8
    No, it is not exaggerated. Once an account is owned, it is owned - For example, depending on what the service is, and what functionality is present, a user may be able to create a surrogate account (e.g. a forwarding email address, a secondary admin account, etc). Granting someone else "temporary" access to your identity is usually no such thing.
    – AviD ♦
    Commented Jul 22, 2011 at 0:21
  • 12
    I might give him the finger, though ;)
    – Piskvor left the building
    Commented Jul 22, 2011 at 10:07
  • 4
    @Kevin, but thats not the same thing as "borrowing" your password... If the admin resets or takes over your account, there is auditing. Also, dont forget things like e.g. EFS, where changing a user's password still does not give you access. The problem is this mindset that effectively a sysadmin is God - this is not true, nor should it be the case: God does not have to justify his actions, a sysadmin does.
    – AviD ♦
    Commented Jul 23, 2011 at 21:18
  • 1
    You shouldn't give your password to the admin, he should have sufficient privileges that its not needed. However, the sysadmin can just legitimately man-in-the-middles the service (he has the required certificates+keys and network access) and get your plaintext password that way.
    – wireghoul
    Commented Jan 30, 2015 at 12:10
15

It was explained before that nobody should ever give its password to an administrator (i'm ok with all of it), but you should check with his superior what's going on, because if he asked yours, it's possible that he asked the password of the 18 others ( the 19th is probably his superior) and i'm pretty sure that some of your fellow co-workers use the same password everywhere.

Improve this answer
2
  • +1 good point. Check with supervisor, or with policy, to see if the admin should be asking.
    – Rory Alsop ♦
    Commented Jul 22, 2011 at 9:50
  • 5
    And, if so, probably go and have those policies updated...
    – AviD ♦
    Commented Jul 22, 2011 at 11:08
11

Short answer, if he is an admin he should never need your password. The worst case scenario is that he needs to resets your password and give you a new one (which you would promptly change).

Unless there is some mitigating circumstances, passwords/codes/phrases are for you alone. (e.i. if the admin doesn't have a privileged account on your PC)

I have entered a few jobs where a long-time employee will have a one-off machine that doesn't have an admin account that i can use on it, but even then it's a better solution to have the user (assuming they have the rights to) make the admin a privileged account that they can use. So even then i'm hard pressed to think of any viable reason why the admin would need your password. It's always a sad day to learn that the user doesn't have administrative rights, it's not connected to the domain, and the admin that set it up hasn't worked there for 10 years......

p.s. as said in another answer, it is possible that the admin is used to getting the "get it done" treatment from their superiors, which may result in them just asking for passwords.

Improve this answer
1
  • 6
    p.s. if the password is the administrator level password or a password to an external service that the admin does need access to, he does need the password (or needs an administrative level account created for him on that service). My response was from the perspective that it was your password. If it's for a company service, i.e. the company's web-host, it's not "your" password. Even then, it's preferred that each individual has separate logins (for accountability/auditing purposes).
    – Ormis
    Commented Jul 25, 2011 at 18:15
6

It may be time to dig out your IT security policy. If you have one in your organisation. If not, time to get the team to sit down and pen one.

It may be the case that this admin has not read it or been trained.

A culture of giving out passwords will certainly increase the chances of accounts being comprised if there are not checks in place to verify each and every request.

The issues raised about accountability are also a bit of a concern.

It's not good practice for sure.

Improve this answer
6

There is also one other problem with password sharing.

If anything happens to your account or by your account while someone else is logged you are the one who will be blamed. Even if inside the company is ok to share password by security policy, legaly (by law; at least in my country) you are the one who will be accused.

Improve this answer
6
  • 1
    That's interesting; I'm not familiar with local laws there, but in most places, being able to prove that someone else had your password (either stolen, or given in a "legitimate" way) can cause serious repudation issues, i.e. absolve you (-ish) of responsibility).
    – AviD ♦
    Commented Jul 22, 2011 at 8:12
  • I know one girl few years ago gave her mail account to her boyfriend who then sent some blackmailing mails. She was found guilty, despite proving mails were not sent by her. EDIT: Well, anyway, even if you can prove it wasn't you and by laws you won't be found guilty, it's still unpleasant situation, don't you agree?
    – StupidOne
    Commented Jul 22, 2011 at 8:16
  • Absolutely, I agree with that point completely.
    – AviD ♦
    Commented Jul 22, 2011 at 8:28
  • 1
    Look at an y Term of Services for a service and you will confirmed that password is your sole responsibility.
    – M'vy
    Commented Jul 22, 2011 at 8:54
  • @Mvy, of course. But what happens when you can prove that someone else has it? Is it your fault and you bear responsibility? Or repudiation?
    – AviD ♦
    Commented Jul 22, 2011 at 9:04
1

The core question being asked is, "Is it ever necessary for an admin to ask for a password?" Clearly, it should not be necessary. But let's define "necessary" as "required in order to accomplish something critical".

With these parameters, in cases with severe / breaking flaws in the security infrastructure it may be necessary to expose a password to accomplish critical tasks. I have seen fouled up systems in both large corporations and government that were run like this for years before I ran into them. And from the standpoint of keeping the operation running, yes it was necessary to continue having that sort of password exposure while fixes were made.

The key in each case was to document the problem, document and clearly communicate the risks of operating under this flawed security situation, get a statement of policy from leadership directing under what circumstances password exposure should occur while fixes are made, then to document any password exposure necessary to continue operating while the security system was being corrected.

In short, it should never be necessary. But if it is, protect yourself by moving the risk of liability off of yourself and onto the party responsible for the decisions / infrastructure that made it inappropriately necessary. And of course if there is no move to fix the problem, you might want to consider moving on.

Improve this answer
-2

If the admin is trying to diagnose a problem only you are having, there might be good reason to access your account "as you" to identify your problem efficiently. You have a lot higher probability of getting your problem fixed if you make it easy for them.

Consider, that your data is not really secret from the sysadmins, so the only thing you're actually protecting is the password itself. If you're already following good password hygiene, it has no value as long as you change it again as soon as they are done.

The alternative - that they have a back door to bypass the need for passwords, is not really attractive either.

Improve this answer
4
  • But the data can be made secret by encryption, no? I am not sure what you mean with "back door". Officially, there are no back doors in linux ;)
    – BЈовић
    Commented Jul 10, 2013 at 5:59
  • This is about a service account and incoming email. There's no separate encryption (or if there were, the user password would be irrelevant.) As root in unix, I can change your password and log in as you. How's that for a back door?
    – ddyer
    Commented Jul 10, 2013 at 18:03
  • @ddyer: What's a service account?
    – unforgettableidSupportsMonica
    Commented Jul 14, 2013 at 17:29
  • 4
    -1. AviD has pointed out that if the sysadmin resets your password, it creates an audit trail, whereas if you change it for the sysadmin, there's no audit trail. Don't share your password: instead, ask your sysadmin to reset it then to diagnose the problem.
    – unforgettableidSupportsMonica
    Commented Jul 14, 2013 at 17:33
-2

Maybe.. How much do you trust them? Do you use this password anywhere else? If it's the same password (or some simple derivation thereof) that you use to gain access to places which allow direct manipulation of your finances, then you better trust the sysadmin not to use your password to gain access to those areas. Amazon Customer Service: "Well sir, our log files and audit trails show that you purchased those 1200 copies of "Sharknado 2". "

Is your convenience more important that your security? "Man... If I don't give the sysadmin my current password, they'll change it and I'll have to change it again in my phone's email setup. BOGUS!!!"

Is the password one that would embarrass you for people to know? (favorite Reality-TV star, swear word, sexual position...)

The above examples suggest that the answer would be "no". But...

The sysadmin: "Since you decided to encrypt your hard drive with Truecrypt which the company does not support, I can't recover any data from your laptop unless I have your decryption password."

So the answer is not going to be 'yes' or 'no' in every circumstance. The answer depends on the circumstances surrounding why you are being asked for it.

And.. always consider who besides yourself could be harmed in some way if someone besides yourself had your password. Secret Service: "Mr. President! You gave the nuclear launch codes to that guy???"

Improve this answer
1
  • 2
    The answer is not "maybe", nor is it a qualified "not usually", the answer is strictly "no". See the other answers if you don't understand why. I'm honestly shocked that this answer has been here for over a year without anyone down voting or commenting on this. To anyone else reading this, don't believe this answer, read the higher voted answers
    – Kevin
    Commented Mar 18, 2016 at 18:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .