You're an IT consultant. Should you discourage a client from telling you their password?

Question

I'm an IT consultant. One client has known me for a few years. He wants me to do some work on his kids' laptop again. I'll need to log into his kids' Windows user account. (I'm guessing that multiple kids share one account.)

This time, he wants to drop the machine off with me. He'll want to tell me the kids' password ("plan A"): he trusts me. But I don't want him to get in the habit of insecure practices like sharing passwords with IT consultants.

I could propose and encourage a "plan B":

• He changes the kids' password to a new, temporary password.
• I log in, do the work, then force a password change at next logon.

Or I could encourage him to make me an account so that I can follow a "plan C":

• I reset the kids' password.
• I log in, do the work, then force a password change at next logon.

Still, I want to keep him happy, and I don't want him to waste time or money. I don't want to encourage plan B or plan C unless absolutely necessary. I wonder:

1. Is it really so bad for him to just tell me the kids' password? If it's bad, please explain why, and please cite a source if you can.

2. (Optional:) I always tell customers a per-hour rate. But lately, I've been billing by the minute. If we choose plan C, is it ethical for me to bill him for the extra minutes it will take me?

Answer 1

When dealing with home or small business customers, I would go with "Plan A." As Adnan said, it's guarding trivial data. Bypassing the password, or even retrieving it, is fairly simple.

To answer your questions:

1. I cannot think of a single reason why it would be bad to know his kids' login password.
2. Ethically, you should bill for standard protocol only. This is what is agreed upon, and paid for. If you communicate a standard for password handling, your customer can either accept that or reject it and find business elsewhere.

Plan B is the most time-consuming. Your customer might not be able to access the computer to begin with.

Generally we asked customers "how can I login?", logged in the default admin, or reset the password and had them change it upon return. If you cannot do this quickly, notify your customer.

As an IT consultant, be consistent. If you are treating someone you've known 2-3 years different than a brand-new customer, you're compromising your policies.

---

When dealing with an enterprise or government customer, you should never know their password. You should never ask, and if they try or succeed at telling you their password, report them immediately.

The government project I worked on, we used Plan C through Active Directory. A customer once complained I reset their password (instead of Plan A). Our cyber-security manager chewed out the entire upper management and saved my bacon.

Answer 2

The problem isn't with this situation in particular. Let's assess the situation here:

• You're a trustworthy person to them
• The password is very likely securing trivial data

Giving you the password isn't that big of a deal in this case. The problem (like you stated in your question) is that getting him in the habit of giving out passwords.

I'd definitely go with plan B. Why?

• It's the best compromise between security and convenience in this case.

• It'll teach him about not sharing password, especially if the lesson is coming from a trustworthy person to him.

• It'll make you look even more professional and shows your interest in your client's security.

• You don't know, he might spread the word about this situation and in a way you'd be contributing to a better understanding of security (in this kind of situations) in his circle of friends/family.

As for your second question, I don't think I'm the best person to answer this, but I'd say no. If something takes you 2-3 minutes and it's obviously trivial compared to another task (fixing whatever is wrong with the computer) don't actually bill the client for the extra 3 minutes of work. It makes nobody look good.

Answer 3

I'd suggest plan B to him, but not push it if he doesn't want to bother.

You will have unsupervised physical access to the laptop - unless there's a disk encryption password you haven't mentioned, that's almost certainly enough for you to do whatever you want without any account passwords anyway, including installing backdoors for later remote access, and knowing the password just saves you unnecessary work.

So if he's right to trust you, he doesn't need any extra security, and if he's mistaken to trust you, the temporary password change (or extra account) doesn't give him any real extra security.

On the other hand if it doesn't already have an unprivileged guest account, encourage him to set one up, so if his kids let their friends use it, they can use that. (And if you can do the necessary work from such an account, use it yourself, but that seems less likely.)

Answer 4

I support TildalWave's suggestion.

Actually, I think you should rather go to his home, and show him how easy it is to crack password, for example with Cain & Abel (without showing him how to obtain this software, nor which software it is, so he won't be tempted to do that by himself later). THEN you change the password with him, and give him some tips about some strong password and good security habits.

I think that your showing him these things will strengthen your mutual trust, not lower it.

But if you can't come to his place, then yes, just allow him to tell you his sons' password, as it won't have any "shocking effect he can learn from" to ask him to change to a temporary password.

About how much you can charge... well, it looks like it's a friend more than a client, so charge him like a friend, not a client.

Answer 5

Ask yourself, would it be any more difficult for you to abuse this person's trust in you by following any of the proposed plans, and if you really wanted to? I don't think so. Each of the plans you propose are just as easily exploitable - by someone else than you. Why do I know that you won't abuse his trust? Because you came here to ask about your dilemma; Something that even a slightly less honest person would never consider, and a completely dishonest person would rather seek deniability sham on a public website that makes it easier to prove this person's identity.

So, the way I see it, your dilemma isn't in proving your trustworthiness, or preventing any doubt in your honest intentions by proposing plans that might require less of it, but more you being unaccustomed to business acquaintances laying so much trust in you also in private life. You have probably earned this trust in other ways before, and this person is prepared to move this friendship forward. Something that, it seems, has hit you as a bit of a surprise, I imagine?

So, we have these three plans, neither of them perfect in an untrusted setting, and all of them nearly identical in a trusted setting. So I propose you simply follow a plan that will be the easiest for both of you. Simple as that.

As for the payment, here's what I do in such situations: I never charge for it, or ask any compensation or return favors. It's mostly routine tasks that I can easily complete anyway, and if they're more challenging (rare), I take it as that - a challenge. Even better. If however, the person I'm doing this favor to insists in repaying me in some way, I'll either accept a small token of appreciation (invitation to a beer, a piece of the pie his wife baked,...), or if money is offered - give a web address of my favorite charity organisation and ask the person to donate that money to it and never ask about it again (but once I'm away, so if it's difficult for that person to part with the money offered - some can be too generous - , they can keep it without remorse).

Answer 6

In this particular instance, I would either say go with Plan B or just accept his password.

Plan B makes most sense, provided you also explain exactly why you are doing what you are doing.

However, in some instances, especially if its a shared password used by all the kids, changing the password can be a pain. I am thinking in particular of Apple. I very rarely need my Apple ID, and invariably forget the password and have to go through the usual security questions etc before I can reset it. But every time I choose a new password, and make it an obscure variation on something memorable, I get told I have already used the password. This is a pain, and if a few people are sharing the same password, the chances of locking the account can be quite high.

So make a judgement call.

Answer 7

Plan B is safest, because you never see what the person's password pattern is (almost everyone has a pattern they use to pick passwords) Plan C is a good fall back. Even if he changes it back to what it was, You did your due diligence in suggesting and helping him with the password change and you can legitimately say you do not know the password if anything happens later. (you don't know unless he tells you that he reset it back to what it was)

Answer 8

I think all plans are not fun for the client. but by necessity, plan B should be done.

This is a waste of time and money. but you have to tell your client to hide all of their important data first, before you randomize computer. I think the browser in a password that is more important.