2

For example I have this complex personal password cary1bondoc21cary2bondoc as my password and because I am forgetful I also want to used that in work related accounts like company email, etc. Is there a chance that my company can record the strokes that I've made while I am in their offices, which will eventually to them knowing my personal passwords?

  • That's going to be up to your organization – schroeder Jul 25 '15 at 0:34
  • 2
    No, it isn't. Single point of failure. One ring to rule them all and all that. The first assumption in hacking is that the mark is doing exactly that, using the same password everywhere. – Fiasco Labs Jul 25 '15 at 1:17
  • No, it is not safe... Always use different password for different account. The world is a dangerous place. – user81789 Jul 25 '15 at 12:04
4

I think this question can begin to be answered by this graphic, which shows what security people think versus average people about best practices for information security.

Note that the average person thinks using a strong password (meaning a complex, difficult-to-guess gibberishy password) is a priority, while security professionals view a unique password (meaning one that you only use for that particular purpose) as a priority.

In corporate environments, sometimes IT staff have a legitimate need to request your password (although it's not a good practice, they still do it..). Also you cannot be sure of the security of the database holding your password, or if monitoring software is installed that would give IT staff access to that password. So, having a unique password for your corporate environment is certainly a better practice for your own safety.

In general, it is a poor practice to reuse any password on different sites. I prioritize using unique passwords, as you never know if the site you have logged into will be hacked. If you use the same password on a site that is compromised, attackers may try to use that password against other known sites like PayPal, facebook etc.

This is where security professionals' 5th preference comes in: use a password manager. If you use a password manager like KeePass or LastPass, you can more easily utilize unique and strong passwords. Then, you can use your complex password as your "master password," and for no other reason as you do not want this password to ever become known. You can also enable two factor authentication (security professionals' #3 preference!) to better secure that master database. This is a better practice in the real-world than re-using passwords, or using formulaic passwords (e.g. that include the name of the site at the end of the password).

  • That's a very good explanation regarding your link. – Cary Bondoc Jul 25 '15 at 1:13
3

You should never reuse passwords, because this way, if someone somehow steals you the password for a personal account, they have immediate access to other accounts. Also, this way he/she would also get access to your work account and could impersonate you there.

Also, yes, your company can be recording your password, it could even store it in plaintext. It varies among companies.

And for your personal passwords, so that different sites get a different password, use a password manager. This way you only need to remember one personal password.

  • So to be more careful I should never open any of my personal accounts like online banking, facebook, etc in a company premises? – Cary Bondoc Jul 25 '15 at 0:58
  • 1
    In fact that is the case. If you really need to access those accounts, better use a personal phone with mobile Internet access. – Cube Jul 25 '15 at 1:01
0

It's never a good idea to use the same password in different places. If you're having trouble remembering your passwords, have a base password, then append something to it and make that your actual password.

For example, let's say your base password is cary1bondoc21cary2bondoc

At work, you'll use cary1bondoc21cary2bondocworking

Your facebook can be cary1bondoc21cary2bondoconfacebook

Your gmail can be cary1bondoc21cary2bondocatgmail

That way, one compromised account doesn't necessary lead to another compromised account. Of course you can, and I suggest, you append something that's not as guessable as the example I gave above.

  • 3
    I would not recommend formulaic passwords like this, as hackers know that people do this and may be able to predict the password based on this. – Herringbone Cat Jul 25 '15 at 1:04
0

Whatever the strength of your password is, do not reuse it for the simple reason that positively reputed ecommerce websites may store your password in plaintext (which thing I personally experienced). So in case the database of such websites is compromised then the common reflexe of a hacker is to try reusing your password elsewhere.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.