How do I prevent colleagues from making fun of the length of my password?

Question

At work, we were required to choose login passwords on our first day. I choose a long and complex (mixed with numbers and symbols) password, it's easy for me to remember, but hard for anyone standing or staring over my shoulder to guess.

One of my team members noticed the length, laughed and asked why? I explained to him that I take password and security seriously, at home I use KeePass and regardless of the service, I make sure to choose a long and complex password(if the service allows it, for example Gmail, I use a 64 character password and my KeePass database holds it).

The team member goes around telling people I have a long password as if it's something to laugh about. I don't see why having a long and complex password is funny. From the moment I became interested in computers, I often read on websites and blogs about using long and complex passwords and setting up a password database.

Edit: Let me clarify a few things:

• My password at work is long and complex but not 64 characters long, but longer than your password for the average person.
• The 64 character passwords are for when I'm at home and I use sites that support them(Example: Gmail).

The point I'm trying to make is regardless of where I am, I favor long and complex passwords as a natural habit, not after a security issue or a personal computer disaster.

I'm a very introverted and non confrontational person, but how do I politely approach my co-worker and ask him to stop spreading around that I have a long password?

Answer 1

Professionally, I'm a sysadmin. The bane of my life is users who won't take security seriously, those who treat it as a joke, as your colleague does. Many years ago, I used to have an Oracle DBA who took pride in having a one-character password on all the systems he had access to - and on the Oracle account, to boot. It made me weep tears of blood, trying to explain to him what potential damage he was opening the company up to.

Somewhere in your enterprise, I promise you, is someone just like me. Every time your colleague laughs about your password, it may help to think that at that very moment that person is blessing the ground you walk upon. If they're a vindictive bastard like me, they may also be praying that that same ground opens up and swallows your co-worker; but they might be nicer than I am.

Edit: I note the highly-rated comment asking for clarification on what I think the OP should do. Personally, I think that changing oneself, for example deliberately choosing to see things in a new light, is one of the few changes to anything that any of us can reliably make. But for those who don't regard change your mind as something you do, let me be explicit about it. Given that the OP describes him/herself as "very introverted and non confrontational", then like Kilisi, I recommend doing nothing. But the OP is doing that now, and it's clearly not working for him/her. So this answer is about how (s)he might do nothing and yet feel better in him/herself.

Answer 2

You just ignore that sort of thing and eventually your colleague goes to bug someone else. Don't feed him and don't let it impact your morale; it's not important.

Answer 3

I am surprised no one gave an answer in these terms, so I joined this site only to do it: For your own sake and your personal grow, please learn to get over it.

Judging by your question, not only this is your first day of job but also you may be coming fresh from college. There is a lesson to learn about the difference between college and the real world.

If someone making some fun about your long password, probably with no bad intention at all, seems to you even vaguely close to harassment, then it's time to invest efforts in getting a bit stronger (or less weak). There is a line separating real harassment from small annoyances that form part of any normal social interaction, and it is important to learn to distinguish between both situations.

Answer 4

There are several ways to respond to people making fun of you. One of these is using humour.

Every time you hear him making a comment about the length of your password respond with your little comment along the lines of:

You seem very keen on comparing lengths, you wouldn't have any insecurities by any chance?

Answer 5

Can you just turn the table?

Based on your work profile, you can use this opportunity to have an hour session to explain about

1. Password Entropy
2. Why a short gibberish (hard to remember) is never better than a long four random words

Alternatively, if your workplace permits, take a print-out of the xkcd cartoon and paste it on your wall than summarized why you prefer to use a long easy to remember the password

Answer 6

Ignore him.

It is your first day at work and this guy is already mocking you for a ridiculous issue. What happens here is not that the guy has found your password funny, it is that he was looking for something to make the new guy feel uncomfortable.

In other words, he is just a bully.

And, while probably there is some corporate policy in place against bullying:

• The issue is so small that raising it to HR probably will make you look bad.

• If HR takes the issue seriously and decides that keeping both of you working may bring legal issues... who is easier to fire? The veteran employee or the newcomer?

If you talk back, you let the bully know that he has hit his target. And it may be worse, because (by virtue of experience) he knows who to forward your replies to for maximum effect (and he will not have your best interests in mind).

If he just jokes about it without addressing you, ignore him. If he tries to talk directly to you, just look silently at him as if you are expecting him to say something consequential. When he stops talking, just look at him as if you are expecting him to say something serious. Kind of a "Ok, you have distracted me from my work. Now that you got my attention, what is so important?" attitude.

Answer 7

Based off discussion in comments I've decided to put forward my own answer.

I'll confirm first that his actions are unprofessional and degrading - the fact that he's not just mocked you to your face but to others behind your back is unacceptable; it doesn't matter if it's something as inconsequential as a long password or a major cock-up that runs a project into the ground - you have a right to not be made target of ridicule, however petty.

People aren't wrong in that you may not need to do anything and he might get bored and drop it in time. I would consider this unhelpful if he then simply picks up something else to tease for later on. It's okay to not want to cause a fuss and it's entirely your call if you want to do anything more to address the problem.

If you want to take action in this situation, you might consider raising the issue with him yourself. At this point I'm going to give him the benefit of the doubt that he may not be aware he's bothering you and may consider it acceptable banter. You could tell him that his actions are making you uncomfortable and/or that you don't think he should be looking at your password in the first place - let alone commenting on it. It's generally best to sort out interpersonal issues yourself where possible. However-

It's okay to tell someone else if his actions are bothering you.

If he persists and it continues to be a cause of concern for you, I'd advise you get in touch with a manager or supervisor. It doesn't need to be a full on grievance procedure, just ask if you can have a chat about something that's bothering you and then bring up that someone (you need not name names immediately) is making petty comments about you that are bothering you. They are in a position to handle it in a manner appropriate to the scale of the conflict.

Letting a superior know that someone is upsetting you is not a declaration of war; part of their jobs is to facilitate cohesion between colleagues and be an impartial overseer of any interpersonal conflicts. They can't do this if you keep your head down and say nothing!

It may end up being nothing and no issue but even something this small, if it goes on long enough, can get out of hand.

Answer 8

I'll present some information from studies on childhood bullying, because while you're not a child, honestly, the dynamics are the same—you're being bullied and it's bothering you.

1. Change your mind about the bullying from "a thing that distresses you and violates your personal rights" to "a puzzle to be solved."

   From Annuary of Clinical and Health Psychology, 2 (2006) 15-25

   Coping strategies: mediators of long-term effects in victims of bullying?

   On one hand, when we considered the perception of control, the victims with less perception of control on bullying episodes showed higher stress levels. On the other hand, students who considered the conflict more as a challenge than a threat experienced lower levels of stress in adult life. ... [E]ven if the perception of control was imaginary, the stress buffering finally reinforces it. ... The perception of control may be considered an efficient protector in victim populations.

2. The more you show that he bothers you, the more he gets what he wants. One of the better coping strategies is ignoring the situation, "so as to show the bully that bullying had little effect." In the study above, fighting with the aggressor or other confronting strategies tended to lead to more problems than the bullied child could handle at once.

3. Another article, the long-term effects of bullying, from mentalhelp.net also seems to have some good practical advice that may be of use to you. For example,

   [M]ultiple researchers point to the protective effect that a good social support network has with regard to [a] bully victim's short and long term outcomes. Having ... [people] who can be confided in when one has been bullied and who can offer support and advice tends to lessen bullying's impact.

   [W]hen a bullying victim is surrounded by ... a supportive social network, they are receiving many positive messages about their worth from network members, and there are thus fewer opportunities for bullies' negative messages to find purchase and grow ...

   This suggests, find some friends who think the guy is a jerk and can commiserate with you about it. You'll feel supported, won't be as bothered by him, and this alone will make him want to do it less.

If you do want to resist him—I'd think carefully before setting up a big war or making a big insult, especially because these can show you're bothered which is not a good idea—but you could say something along the lines of "[shrug] doesn't it make sense to you that each person uses as big a password as he's capable of remembering?" Then turn away and act like you've dismissed him—get busy with something job-related. If he says something more, say "what, you're still here? Dude, don't you have work you should be doing?" then dismissively turn your back again. Walk away from your desk or involve someone else in conversation, pretending he's not there. Make sure you say everything in as low a tone of voice as possible, that falls at the end instead of rising. Go watch the video The Impact of Tonality and use it! There are many other videos by that same YouTube channel, Charisma Matrix, that could help you.

Answer 9

Not many answers actually address your question - how to make him stop going around the office making you look bad. The reason (password) is secondary. This is not about your password at all, it is about a guy making fun of the new guy.

You describe yourself as non-confrontational, so IMHO you should politely but firmly say something along the lines of "Hey Fred. Everyone has had their laugh at the new guy, you can stop now."

In many workplaces, making some harmless fun of the new guy is a ritual, maybe even a rite of passage. It is also a check on the new guy. How do you respond? Will you immediately run to HR and file a complaint? Are you a good sports who shrugs it off with a laugh?

The best you can do, if it stays at this level, is to not put too much thought on it, and most importantly don't change yourself. Yes, your tag is right, this is unprofessional behaviour, but almost every workplace has at least one such person.

If it gets to the point of not being a harmless fun anymore, the first person to involve after the guy himself is your immediate manager. Simply tell him that you feel uncomfortable and are not sure how to handle this situation, or how to judge it. If this guy is just making a harmless joke or not, so you are asking your supervisor for advise and help. He can talk to the guy at the coffee machine and ask him to stop and nobody lost face.

Answer 10

Your co-worker is right. You're not using a password. You're using a passphrase. And, there is some humor to this notion.

As famously pointed out by XKCD.com/936: Password Strength (copied and visible in Abhijit's answer, although missing the hovertext like most blatant copies of XKCD graphics do), there are a lot of misperceptions about what makes for good security credentials. In many, many cases, a much stronger method would be to use a cryptographic key which may be hundreds or thousands of bits long. That would be ridiculously challenging to type (I've never actually typed one out myself), but techniques such as effective use of ssh-agent can make such strong security easy to implement on a day to day basis.

The problems with such technology are issues like user education and perhaps compatibility with some software solutions, both of which we can hope to eradicate. Oh, and unfamiliarity by people who select security methods. Education may be able to eliminate all of those problems. I look forward to the day.

Until we achieve such simplicity (of day-to-day usage), the use of passwords is sort of a compromise. Until we can get into a better situation, a much better approach is to limit where passwords are typed so that they are just used in secure scenarios, and then use secured and trusted computer to send more elaborate credentials which are even harder to re-produce manually. But manually going through a lot of effort to achieve better-than-lousy, but worse-than-achievable security just feels like a decision that accomplishes the worst of both worlds.

I myself have admired my best friend's knack for using lengthy passphrases. Also, he ends up making typos and needing to re-type them with some amount of regularity. I find this humorous because I myself can have the same issue with passwords of lengths like 8-13, and so when he gets to his fourth or fifth or sixth word, I feel like he's bringing on such troubles to himself very unnecessarily.

Really, if you analyze this from a cost-benefit scenario, what is the great benefit of extending your password length to things like 35-45 characters? Certainly if a person sticks with 15-19 characters, they will achieve the goal of being abnormally long, more secure than most people, and more secure than what most botnets are going to be able to easily crack. Therefore, the extra twenty-plus characters (or, you're saying forty-plus characters for some passwords you've used) beyond a length like 15-19 just end up being pain-inducing complexity without providing significant benefit. That is why the judgement error is a cause of humor. Best case scenario, you're taking extra time out of your day as you type it correctly each time. (Worst case scenario is that you're taking even more time.)

So although I do admire my friend's willingness to take a serious stance on an important issue like security, I do also find his decision to be a bit misguided. These days, I typically try to keep the laughter to myself just out of politeness, but sometimes do tend to comment on it when I see him needing to try a fourth time to get his passphrase right. (And since I can see how many characters he types, it is usually some of the later characters that get to trip him up.)

how do I politely approach my co-worker and ask him to stop spreading around that I have a long password?

You might also want to consider the IPS stack exchange. That site seems to have lots of questions about "How do I communicate a message that I want to communicate, and not experiencing expected negative results when I know that the person won't appreciate hearing what I want to communicate?" Rephrased, the question is, "how do I do what I want to do, and take away another person's right to respond in a way that person is likely to do, just because I don't want that person to respond that way?" It's really an unfair question, and often the correct answer for a Workplace is to not try to control other people, but just do your part in getting along. But since you asked, I'll go over some possible options.

First, realize that your co-worker may be feeling like he is doing you a favor, by ridiculing you until you re-assess your ways and make more sensible decisions. So this might be more than just him trying to take advantage of an easy opportunity to make a joke. Embarrassing a person into desired actions is a technique that can be effective (at least sometimes), and so your co-worker might not be easily dis-swayed. (Note that I'm not saying that the technique is ethical, even if it seems to reach a desired result. I recognize there may be side effects. Your co-worker may not be considering those as much.) His belief that he is doing you some good may empower his decision, even if you don't like his belief, and even if his belief is actually wrong.

You might need to resort to unpleasant techniques like trying to appeal to a higher authority who may impose behavior restrictions so that your co-worker feels that job security is threatened. (That's really not a very nice approach. Of course, you could argue that you being harassed is not a very nice approach.) Doing that might curtail his behavior.

Another option may be to comply with the behavior he is suggesting from you.

Note that there are compelling arguments why some of the approaches in the prior paragraph are so awful that they should not even be considered. (Some would object to empowering him further by letting him win with such a mean-spirited approach. Some would object to disempowering him through such harsh measures as getting management involved.) So I will not take a stance on which approach is most or least right. I'm just saying those are some of the options that are possible. Some approaches might work better or worse for some people, and may be situational-dependent.

Another option may be to respond. Just say, "When someone gets into our systems because of a short password, it likely won't be my fault." You can shorten that over time. This may actually inspire him to fight more/harder, realizing that a reaction was developed. So the short term result may be to worsen the situation, from your perspective. But if you just keep with the same old reaction, then eventually that exchange will likely bore him into deciding to just drop the topic.

Answer 11

A lot of good answers here, but the question asked was how to approach the person and ask to stop. I think that is best done by sitting down and discussing that it makes you uncomfortable to be mocked when all you are doing is taking your responsibility to do your part to protect the companies systems and intellectual property with a strong password. To put it simply, if the company does get breached it won't be by guessing your password.

That said, I am assuming your password is not long but extremely guessable. If it follows current best practices, then just respond to the ribbing as above.

It sounds like this has actually spread, and if so your strategy for handling would change. You might consider owning it, laughing along, and making light of it -- but all the while maintaining the position that you just thought it was the right thing to do.

Answer 12

First, make sure your long passphrase, and the need to enter it repeatedly, is not actually in your way - if it, say, takes you two minutes to logon, then you have given people grounds for friendly amusement. In this case, use a password that is complex and secure but shorter. One trick to get such a password and yet being able to quickly memorise it is an adaptation of the cartoon above - last panel -> "T'saBS.-C!" Easy to remember if you know the text it is derived from, impossible to remember for someone looking over your shoulder and seeing gibberish.

However, if you are a fast typist (that can enter a passphrase like that within seconds), change your mindset from "I am being stared at and judged" to "I am envied for being a fast typist and capable of remembering a complex passphrase".

Oh, and: introverted but stubborn behaviour can be received as much more confrontational than you think. And that is not a problem at all, at least not yours - use it as your way of being confrontational when you need to confront.

Answer 13

Your coworker's behavior is inappropriate, and if it continues and you feel like it's interfering with your ability to work effectively with them, you should talk to your manager about it.

However in the workplace you often find that managers/HR are not eagar to jump to your defense about this kind of "petty" (in their eyes) misbehavior by coworkers, and so it's useful to think about how to avoid doing quirky things that make you stand out as someone that bad coworkers want to tease. I don't think you should have to do that, but you have to decide how you want to balance effort spent fighting/fixing bad workplace culture against effort spent doing your job and advancing your own career and financial wellbeing.

With that in mind, I think you might be coming into the whole situation with the wrong attitude. Making a 64-character password does make password security look like something of a joke, and probably contributes to a culture of people not wanting to follow good security advice because it looks impractical and ridiculous. A decently chosen 16-character password is going to be just as good for all practical purposes, and won't stand out and look ridiculous every time you go to type it.

I don't think changing your password right now would help - if anything it would probably make your coworker who's already shown they have boundaries issues think they can control you in inappropriate ways - but it's something to think about for the future.

Answer 14

Depending on your office environment, one option is to baggy pants him.

He's laughing at your password for being long; in other words, what he is saying, is that his password is short! So, crack his password, post some embarrassing messages to the office group chat / email list in his name, and when he complains about it you can tactfully (or mockingly, your choice) point out, that hey maybe if his password was a bit longer...

I give you maybe a 20% chance of getting fired (or sued) for this if you actually do it, and maybe a 2% chance of getting a commendation for pointing out a security flaw. Either way, it'll make a great story!

Answer 15

Some thoughts: (based on decades in the industry, so yes, they're all 100% true and real and seen way to many times)

1. He may be musing that you are waaayyyy past the point of diminishing returns on password complexity.
2. He may be considering that password attacks are not usually worthwhile vectors, especially on corporate networks compared to other options. Phishing/Equifax.
3. He already knows what you will soon find out, there are lots more huge vulnerabilities on the company's network other than someone's password.
4. He's just a jerk. Why would you care? In fact, this is the perfect setup to prank him. ;)

Answer 16

Check company policy.

See if you can report him for looking over your shoulder while typing your password and discussing your password with others. Even if there's no specific policy it seems self-evident that one would not do that.

A 64 character password could be 4x longer than you need but that doesn't mean that the other fellow needs to waste company time ridiculing and demoralizing the staff.

How to approach them, just ask normally. Is it likely to be effective or will it instead lead to another round of taunts, that depends upon their maturity and dedication to a positive working environment.

Document how much time he expends by simply making a tick mark on a Post-It note, don't take up a lot of your own time, if you later feel more settled in and wish to take the matter up with the manager you'll have a record that shows time he wasted and the efficient usage of your time.

Since you only need to deal with your long password a single time you are not wasting much time, whether the service you use is trustworthy is another question (not yet brought up by your tormentor).

If you feel comfortable pushing back then tell him you'll have the Security Team review his password (which he can change after revealing it to the management) to determine if it's too short and easy to guess (you have evidence to support that theory, that his mouth is bigger than his IQ and password length combined).

Then he'll be all excited and self-report - so it's not your word (and his supporters) against yours.

People should make newcomers feel welcome and help them fit in, ridicule and harrasment isn't the way, they probably are attempting to compensate for some of their own shortcomings and put the target on you.