I have a user account for each of my children in our district website, which oversees registration, grades, identification, etc.
I was recently sent home a form from both of my children's classrooms asking us to login to our accounts so we could sign a new school year form. Printed on this piece of paper was both the username and the password for our accounts.
The security practice of sending home printed passwords is immediately discouraging, but my larger concern is how my password is stored in the district system (and ultimately, what would happen if that system were compromised).
I want to contact the webmaster, but I want to make sure I'm correct in any assumptions I make prior to shooting off my email asking that action be taken to avoid this kind of thing. I saw a related question, and want to make sure I don't jump the gun on harassing them over their storage policies.
Since it's been asked several times, this is a password that I set on the account, not an auto-generated password. Also, this is an account that parents control; it contains sensitive identifying information of your child. It's not intended as a student portal or anything like that.
I got a call from the district webmaster today, wanting to discuss my email in more detail. I explained my concerns were two-fold: (a) the transmission of our password on a printed piece of paper, and (b) the ability to retrieve that password in the first place.
I was informed that the system is a legacy system, and as such has no capability of allowing a "forgot my password" feature. While the policy, they agreed, is incorrect, the alternative is to have every parent who doesn't remember their password come into the school with an ID to retrieve their password. (I was also informed that since we're in a 60% poverty district, assuming all parents have an email address for password management isn't an option). While this is and incredible inconvenient, I explained the inconvenience of likewise having someone access my accounts because they had access to my password.
I was also informed that the system is being replaced next year, which will come with more modern security features (though, I'm unsure of the storage policies on the future system).
The lady was very polite, and offered to put me in contact with their director of IT to discuss my concerns around password storage policies, which I accepted. She also offered to BCC me on an email to our school principal, requesting that future communications be issued in a sealed format.
Finally, I was slightly (and correctly) scolded for reusing my password in the first place.