1. Welcome! Please take a few seconds to create your free account to post threads, make some friends, remove a few ads while surfing and much more. ClutchFans has been bringing fans together to talk Houston Sports since 1996. Join us!

My IT department insists on me emailing them my password

Discussion in 'BBS Hangout' started by DarkHorse, May 18, 2012.

Tags:
  1. DarkHorse

    DarkHorse Member

    Joined:
    Oct 9, 1999
    Messages:
    6,751
    Likes Received:
    1,294
    This is an absolutely true story. I'm getting a new laptop at work, and today I got an email informing me that in order to do some testing on the new machine, they need to me email them my password.

    What with this being the cardinal sin of computer security, not to mention the classic opening scenario of a social engineering attack, I'm trying to come up with the most creative way to respond to this asinine request.

    The best part is that it's not like I work for some company run out of someone's basement, it's a 10 billion dollar worldwide Fortune 100 company.

    As a former Symantec employee, this makes my head want to explode.


    How would you respond?
     
  2. DaDakota

    DaDakota Balance wins
    Supporting Member

    Joined:
    Mar 14, 1999
    Messages:
    128,557
    Likes Received:
    38,778
    Tell them you will happily come down and enter it while they are not looking.

    DD
     
  3. DarkHorse

    DarkHorse Member

    Joined:
    Oct 9, 1999
    Messages:
    6,751
    Likes Received:
    1,294
    I work in Austin; my IT department is in Wisconsin.
     
  4. Harrisment

    Harrisment Member

    Joined:
    Jun 20, 2001
    Messages:
    15,392
    Likes Received:
    2,158
    This is sadly quite common in the corporate world. They want your password so they can setup your user profile, because most people don't have the knowledge to do so themselves. I'd tell them to get your machine ready to go, and then you can log in yourself and complete the profile setup.
     
  5. Harrisment

    Harrisment Member

    Joined:
    Jun 20, 2001
    Messages:
    15,392
    Likes Received:
    2,158
    Your other option is to just set a temporary password like 'UGuyzRAmat3urs' and then change once they are done.
     
    1 person likes this.
  6. jEXCLUSIVE

    jEXCLUSIVE Member

    Joined:
    Jan 27, 2009
    Messages:
    351
    Likes Received:
    24
    No need to be a jerk about it. Just email them back asking if there is any other way this can be done, due to privacy concerns. If they still insist, send your password and archive and save the email conversation for your records.

    Or simply request a password reset once they have finished thier testing.
     
  7. seclusion

    seclusion rip chadwick

    Joined:
    Feb 20, 2003
    Messages:
    7,499
    Likes Received:
    1,684
    If you're really that vehemently against giving them your password, just tell them to reset it and provide it to you. You can then change it back to whatever the hell you like.
     
  8. DaDakota

    DaDakota Balance wins
    Supporting Member

    Joined:
    Mar 14, 1999
    Messages:
    128,557
    Likes Received:
    38,778
    Fantastic time to visit that area of the country...

    :)

    DD
     
  9. bobrek

    bobrek Politics belong in the D & D

    Joined:
    Sep 16, 1999
    Messages:
    36,288
    Likes Received:
    26,645
    I don't think Darkhorse's issue is with them wanting his password, it is the way they are going about it. Generally we are taught to never send password via email. Technically, if his company is heavy into security, this is a violation of their policy.
     
  10. Tigerknee

    Tigerknee Member

    Joined:
    Jan 10, 2003
    Messages:
    1,294
    Likes Received:
    32
    I ask for passwords from my users all the time. It's more convenient for me to have access to their systems. They are welcome to change it when I'm done.

    No big deal.
     
  11. bobrek

    bobrek Politics belong in the D & D

    Joined:
    Sep 16, 1999
    Messages:
    36,288
    Likes Received:
    26,645
    Chippewa Falls?
     
  12. Air Langhi

    Air Langhi Contributing Member

    Joined:
    Aug 26, 2000
    Messages:
    21,935
    Likes Received:
    6,685
    Change your password to a dummy password and send them that and then change it back.
     
  13. superfob

    superfob Mommy WOW! I'm a Big Kid now.

    Joined:
    May 5, 2006
    Messages:
    2,087
    Likes Received:
    1,393
    Shakes head....

    As an IT admin shouldn't you have access to their systems without logging in as them?
     
  14. Tigerknee

    Tigerknee Member

    Joined:
    Jan 10, 2003
    Messages:
    1,294
    Likes Received:
    32
    No. Can't setup their e-mails, set up their printers or restore their data (which is housed) on their home directories without them logging in.
     
  15. SacTown

    SacTown Member

    Joined:
    Apr 18, 2011
    Messages:
    4,590
    Likes Received:
    235
    Cleverly disguised thread to find out how many cf.net'ers really do work the helpdesk.
     
  16. DarkHorse

    DarkHorse Member

    Joined:
    Oct 9, 1999
    Messages:
    6,751
    Likes Received:
    1,294
    I'm going to go out on a limb here and assume that anyone asking for passwords in plain text isn't CISSP certified.

    And yes, there's no reason why an IT person couldn't just change my password to whatever they want (like "password123$" or whatever they do when you join the company) and tell me about it later.

    Also, why make it easier to be a criminal? How do we ever expect John Q. Computer User to learn to avoid things like phishing attacks when you actually reinforce the idea that "Bill in IT" can call you up and demand your password?

    I just changed my password to "FakePasswordForThisAsinineSocialEngineeringAttack123$%^"
     
  17. Rocket River

    Rocket River Member

    Joined:
    Oct 5, 1999
    Messages:
    65,000
    Likes Received:
    32,705
    Here is the alternative.
    I change your password. I do my testing.
    Meanwhile - you are locked out of your current computer.

    It is a bit of a courtesy really. Somethings have to be tested under your account.
    Testing it under and admin account would not render the desired result because
    well . . .I would have more rights and privileges than you would so . . . .something will
    work with my account that won't work with yours. Not to mention setting up your
    personal settings etc etc etc.

    Trust and believe. . they could simply reset it. Without telling you
    then you are calling asking them what happened. . they go . .
    "OH! We changed it to test the new machine . . . "
    Then all of a sudden they are 'inconsiderate jerks"

    As for security. The window of opportunity from someone
    getting your password over the company secured email . . .then utilizing it
    before testing is done. . . probably not high .

    I'd suspect they will tell you . . you will have to reset your password anyway
    when they give you the new one.

    Rocket River
    Just my .02$
     
  18. Tigerknee

    Tigerknee Member

    Joined:
    Jan 10, 2003
    Messages:
    1,294
    Likes Received:
    32
    Now plain txt is something I don't ask for. Always verbally. :)
     
  19. cdastros

    cdastros Member

    Joined:
    Nov 6, 2002
    Messages:
    1,915
    Likes Received:
    1,443
    Are you sure this email is from your IT department? You should call them first and confirm. this could be phishing.
     
  20. bejezuz

    bejezuz Member

    Joined:
    Jun 26, 2002
    Messages:
    2,772
    Likes Received:
    69
    It's a bad policy to ask for a password if your IT guy is dishonest, because dumb people use the same password at work as they do on everything else on the Internet where their vital stuff is stored. However, if your IT guy is honest, he might either be a bit amateur or he might just be tired of people complaining when he resets their password because they don't know how to change it back.

    Ask for his phone number, call him up and explain to him your reservations. Don't be a jerk, this might not be his fault. If he's a jerk to you, then you can make a big deal out of this.

    Honestly, treating an IT guy like a human being is the best way to get seriously good service. Most IT guys are walked all over their entire lives and react poorly to confrontation. But if you befriend them, they'll go the extra mile for you just because you're nice.
     

Share This Page