How can I protect myself from false accusations when our company practices password escrow?

Question

During an internship for a small company, my boss created an account for me, so I generated a password and I used it. The next day, my boss told me to write down the password of my account on a piece of paper, put it in a letter and to sign the envelope. Then he took the letter and told me that if he needs to access my account and I am unreachable, he is authorized to open the envelope and read the password to use it.

He also told me that this is a common practice in all companies. Now I don't know if every company does this (I don't think so) but, to me, it's not legal.

Let's say that my boss is a bad person (he's not) and he wants to frame me for something that he did. He only has to open the letter and read my password (let's say that I'm unreachable) and do his nefarious activity with my account.

Now let's say that I can't prove my innocence. How I can prevent all of this? I thought of writing down a wrong password, but if he really needs my account and I'm unreachable, I'll put him in a bad situation.

So, is there a way to protect myself (without refusing to write down the password)?

Answer 1

That's what the envelope is (or should be) for: In order to use your password, one needs to break the seal of the envelope you signed. When you think your password was abused, you can ask to see the envelope with your signature and check if it is still unopened.

All you need to do is that should your management ever require your password, change the password and hand in a new envelope. You might want to change your password in regular intervals anyway: It's common best practice.

By the way: In companies with a proper IT management this method is unnecessary, because system administrators can receive any necessary information from user accounts without having to know the passwords of the user. If an administrator really needs to log into a user account, they would reset the password (which would create a verifiable audit trail). And there is usually more than one system administrator, so the admin accounts do not require this method either.

Answer 2

I don't think you are in a particularly worse situation than not disclosing your password. Your boss could:

• Get the system administrator to make a copy of your (hashed) current password
• Change it to something new
• Do something evil in your name
• Put the old password back (replace the hash back what it was)

What does protect you is that there are, presumably, audit trails of things that are done. For example, tracking emails by IP addresses.

If anything you are in a better situation than before. Now you can plausibly argue, if something bad is done in your name: "But my boss insisted on having my password, maybe he did it".

If the audit trails can be used to prove your boss's innocence in this sort of situation, then it can also be used to prove yours. And if no audit trails exist there will be doubt as to who really did it - whatever "it" is.

Answer 3

Password escrow as described in your situation is highly unusual and loaded with risks. The setup you describe relies on trusting your boss to not only be honest with their intentions and motivations, it also assumes your boss is storing those passwords in a secure manner. Are the envelopes kept in a safe? A locked filing cabinet? His desk drawer? A folder on his desk?

The ideal situation:

Escrow: A system where a disinterested third party holds money/information/property in trust on the condition that certain requirements are met before transferring said holdings to the receiving parties.

In your scenario, the person holding the password is not a disinterested third party. This is less than perfect, but they are being trusted by management to be honest and secure in their handling of the passwords.

Alternatives in other answers are good suggestions. An additional alternative to the current scenario would be to split the password into multiple parts. For example, half the password given to your manager and the other half given your manager's manager(or Human Resources, or department head, or CEO, whatever makes the most sense). How to split the password and how many people have access to which portions of the password will vary depending on the company management structure.

Just as they're trying to mitigate risk by having password escrow in the first place, they should avoid having a single point of failure in the process. Avoiding conflicts of interest and requiring multiple parties to be involved would go a long way to making password escrow safer. It's still not a great management practice, but it doesn't have to be as insecure and risky as just handing the password over to the boss in a plain envelope. Even something as simple and cheap as adding tamper resistant security tape would improve the current scenario.

Answer 4

Change your password immediately after handing him the envelope.

You have fulfilled his requirement of giving him an envelope with your password, and you have fulfilled the need to keep it secure. In the unlikely event that he tries to use the envelope password, you can explain that you needed to change it and he had yet to receive the new envelope.

In no case would I trust anyone with a password of mine, even in a sealed envelope. An envelope is too easy to breach, even without breaking the seal. Even using "security envelopes", placing a bright light (super flashlight, office projector, car headlight) to the back side of it will cause the contents to be able to be seen through it. Considering the information to be obtained is likely a large printed single word, it is not secure. I have never worked for a company that has asked for me to give them a password in an envelope.

Answer 5

Philipp is correct here. Let me restate something he said:

In order to use your password, one needs to break the seal of the envelope you signed. When you think your password was abused, you can ask to see the envelope with your signature and check if it is still unopened.

To add to what he's saying, your company appears to have grossly incorrect IT management practices. What you should do at this point is make sure your password is not the same as the one you use elsewhere.

Always assume your employer has access to whatever you're doing online. Even if they don't. Do not log into your social networking accounts at work. Do not log onto your bank accounts. Use your work computer for work-related tasks. If you have a cell phone, it's even easier.

Your employer should be able to do whatever they want, within the confines of the law, to your work computer. You should not have any expectation of privacy.

Answer 6

This should be completely unnecessary in a properly configured system, assuming you log on to a corporate domain. In a properly configured system, logging on to a corporate domain, any data you edit, create or have access to on the network or on your local system, will be stored in a location accessible by others who each have their own login credentials which will have the necessary permissions to access that data. By using their own login credentials, they not only have access to network data, but also local data and the audit logs will show who did what and when. Be REQUIRED to give your username and password to ANYONE is not only a bad practice, but is highly irregular, risky and/or indicative of incompetent system/network administration.

If I were in your shoes, I would ask his superiors about that policy, change my password and refuse. If your job is threatened, then I would call their/his/her bluff and prepare to file suit for wrongful termination if you do get fired. I personally, would never give that info away nor would I trust a sealed envelope as the security measure to keep people honest (sealed envelopes can be opened and resealed, if you know how or a new envelope sealed with a forged signature.) Even the seemingly nicest of bosses could simply be putting on an act until they turn on you and frame you for something. I witnessed something similar, except instead of a sealed envelope containing a password, it was a disk containing a backup copy of encryption keys. The fallout wasn't pretty and the manager got fired after the discs and data was stolen. Unsurprisingly, the fired manager never got another job, never had money problems and a competitor came to market first with the very project we had been working on. Prior to the theft, our competitor didn't even have a similar product. Be careful and think about my advice. That sounds very suspicious to me and so often in these times, the friendliest/nicest people turn out to be the most venomous snakes.

Answer 7

This is unfortunately common in small companies using cloud services, without having a business relationship with the cloud provider.

Mark the envelope to make it a bit more tamper proof, that's it. A former company of mine still uses my personal e-Mail address in their domain, the never managed to change their domain registration after I left.

Change the password frequently, and hand in new envelopes every time. They would need to produce all old envelopes too, so they can proof they haven't opened one. Since most online services won't provide audit trail. So you can always stand upright innocent.

Answer 8

Let's call it what it is: a workaround for lack of proper access control. The real solution is to fix/improve access control.

Specifically, here: Why can't your boss access the things you can access with his own account?

The only purpose of credentials is to authenticate an identity. If we break that, they become useless. You might as well remove the concept of an "account" and use shared secrets for everything.

So as an alternative to outright refusing, attempting to convince him to tackle the root issue (which probably appeared because of a misunderstanding) might be worthwhile. If argued right, this shouldn't create friction: the ultimate result is a safer system for everyone.

Answer 9

Never had to me in any company I was in.

In such case, I would put in the envelope a message saying "In case of emergency call me on mobile mobile number".

In case of emergency, I can spell the password over the phone and be informed that it was used - and my boss could do anything needed. So it is all he needs.

If the envelope is misused/stolen/scanned/broken - it would not let anyone impersonate me.

Answer 10

The very existence of the envelop protects you from any nefarious doings by your boss. In general, you don't need to prove your innocence. Someone else needs to prove your guilt. And that is going to be quite hard if it is well known that someone else has access to the incriminating account. If you are really worried about it, just sign the envelope wonky. Then, if your boss does manage to read the password through the envelope to do something nefarious, you can refute the validity of the envelope itself.

Side notes:

1. This is not common practice in any large company, but I can see how it would make sense to someone trying to run a small company. In fact, I have heard of several small companies that ran into trouble when a key resource left without disclosing the passwords to various software.
2. If you ever want to commit a crime using your account, be sure lots of other people have access to your password first.

Answer 11

It's a big lie - no one needs your pass to access your account, there are an administrative accounts just to fit this purpose. Even more - it's not a common practice except for cheaters wishing to blame you and reduce/remove your payroll. Neither your pass, nor your certificate(s) are required for an Administrator to take a look at your full account.

Answer 12

If you're worried about your boss opening the envelope, using your password for deeds of nefarious do, and then resealing your password in a new envelope and forging your signature, then just splatter a bit of paint, Jackson Pollock style, on the envelope after you sign right across the glued area, and then take a few very high resolution photos of the envelope to easily identify any attempted Pollock forgeries. Just be sure to also protect the password from any visible, infrared, x-ray, gamma ray, or any other form of peeping radiation that may allow your boss to read your password without opening the envelope, by enclosing your password in a thick lead case before putting it into the envelope.

Of course, you will also have to worry that the had a camera recording you as you wrote the password down in the first place. In that case, make sure you've done all of that at home and that he has never had access to your home.

I think that covers it.

EDIT:

Except of course if your boss rips the envelope open, performs the nefarious deeds, and then starts a severe toaster fire in the snack room next room on the same day that the security cameras are being repaired and are offline, thereby burning up all the password envelopes and absolving himself of any suspicion. So I suggest you spray down the entire room and neighboring rooms with a flame retardant foam. That should solve your problem.

Answer 13

This actually depends on both country and/or state laws that you live. This is more of a question for employment law, than it is a cyber security question.

The reason that this is an employment law question is that it depends on the size of the organization, the data and system in question, the general employment contract, and the company policies.

Companies can and do put write this into employment contracts. Generally, your employee handbook will explain what data, or information systems belong to them, or have clauses in their general company policy that describe what information systems belong to them. If they own the system in question depending on what the system is being used for, they not only have the right to your password, they are legally allowed to do whatever they want with your password, the data involved with the system, and anything in between all in accordance with both the federal, state, and local laws within your jurisdiction.

This is why companies can enforce the use of proxies in order to record information. However, if the system in question is not owned by their organization and you are using their network, then it becomes a grey area because of privacy laws.

The only way to prevent this is the following:

1) In short, you as an employee, can not prevent this, if they own the information/data and the system of which you have access to.

2) Read your employee handbook, your employment contract, and specifically ask what information and data are specifically owned by the company. This includes everything from your ideas, your invention assignment agreement, and any personal information that you consider private.

3) Separate personal use from corporate use, If the company provides you with a laptop, or information system for you to use, do not use it for personal use. This is the area that becomes grey. For instance, if you published corporate secrets on facebook whether its on your personal computer or theirs they may still own the data.

Answer 14

I would say this is typical, and used fairly commonly in the industry. Not the exact same way though.

Many companies use password managers where the they can access employees passwords, and passwords can be shared between employees. This is mostly for logging into 3rd party services that don't support individual user accounts.

This would specifically only be for company related logins though. No personal logins should have this.