<story><title>I hate password rules</title><url>https://www.schneier.com/blog/archives/2021/11/why-i-hate-password-rules.html</url></story><parent_chain><item><author>bsuvc</author><text>A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer.&lt;p&gt;I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password.  Well pass phrase is more like it.  It was something like “sliding down the tall building”.&lt;p&gt;I was quite impressed that they encouraged the use of long pass phrases instead of short cryptic passwords that are hard to remember (think “correct horse battery staple”).  This place really is serious about security, I thought.&lt;p&gt;I thanked the system admin and causally said “I’ll be sure to change this to an equally secure pass phrase”.&lt;p&gt;“Oh no,” he said, “we don’t allow people to change their passwords here. You see, we need to be able to log into anyone’s computer if they go on vacation or are out of the office, so we keep an Excel worksheet with everyone’s username and password. So please don’t change your password.”&lt;p&gt;He turns and walks away, and I just sit there stunned, wondering if this was some kind of practical joke.&lt;p&gt;Sadly he was completely serious.  I kept the password they gave me for the 3 months I was there, as I was asked to do, knowing that at any time someone could log in as me and do something illegal or unethical. It really did give me a bit of anxiety.</text></item></parent_chain><comment><author>lmilcin</author><text>A few years back, on day 1 of my new job I was given root access to one of the development boxes.&lt;p&gt;So I ask: &amp;quot;Okay, how do I log in?&amp;quot;&lt;p&gt;The IT guy: &amp;quot;What do you mean, you just log in using your personal domain account and then sudo su -. You know what sudo is?&amp;quot; (followed by loud sigh)&lt;p&gt;Me: &amp;quot;You mean like production domain, same that we use for our desktop?&amp;quot;&lt;p&gt;IT guy: &amp;quot;Of course! What do you mean, what other domain would you like?&amp;quot;&lt;p&gt;Me: &amp;quot;Can I at least change my password to something else just for the dev environment? Can I log in with SSH key?&amp;quot;&lt;p&gt;IT guy: &amp;quot;No, no, no. Per our &lt;i&gt;SECURITY&lt;/i&gt; policy, SSH keys are disabled and you have to use our domain login and password&amp;quot;. (another sigh... of course)&lt;p&gt;Me: &amp;quot;Are you aware that when somebody has root access to the box they can do whatever they want including intercepting passwords of all users that log in to that box? In this case, every single developer that ever needs access to dev environment?&amp;quot;&lt;p&gt;IT guy: &amp;quot;That&amp;#x27;s not true. SSH is encrypted protocol and it is not possible to access passwords&amp;quot;.&lt;p&gt;Me: after many tries to explain this to various people from IT, I gave up and set out to intercept all passwords of all IT employees. After I had passwords of almost everybody, I put them all in an excel and sent to IT for &amp;quot;verification&amp;quot;.&lt;p&gt;There were a lot of angry people that day wanting me fired... fortunately they came to their senses.&lt;p&gt;Unfortunately, my development box access privileges were revoked.</text></comment>
<story><title>I hate password rules</title><url>https://www.schneier.com/blog/archives/2021/11/why-i-hate-password-rules.html</url></story><parent_chain><item><author>bsuvc</author><text>A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer.&lt;p&gt;I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password.  Well pass phrase is more like it.  It was something like “sliding down the tall building”.&lt;p&gt;I was quite impressed that they encouraged the use of long pass phrases instead of short cryptic passwords that are hard to remember (think “correct horse battery staple”).  This place really is serious about security, I thought.&lt;p&gt;I thanked the system admin and causally said “I’ll be sure to change this to an equally secure pass phrase”.&lt;p&gt;“Oh no,” he said, “we don’t allow people to change their passwords here. You see, we need to be able to log into anyone’s computer if they go on vacation or are out of the office, so we keep an Excel worksheet with everyone’s username and password. So please don’t change your password.”&lt;p&gt;He turns and walks away, and I just sit there stunned, wondering if this was some kind of practical joke.&lt;p&gt;Sadly he was completely serious.  I kept the password they gave me for the 3 months I was there, as I was asked to do, knowing that at any time someone could log in as me and do something illegal or unethical. It really did give me a bit of anxiety.</text></item></parent_chain><comment><author>er4hn</author><text>On the plus side, it also gave you plausible deniability it really was you if you wanted to do something illegal or unethical.</text></comment>