Is it an acceptable practice for IT to ask an employee for their password over Skype Messenger?

Question

I got an email saying my password would expire in a few days, so I clicked on the link in the email and updated it. After doing so, I realized I could no longer log in to my computer, except by disconnecting from the network and using my old password. I immediately opened a support ticket. The next day, I was working from home, and someone from IT finally contacted me over Skype messenger. He asked me what my new password was. I was desperate to get the problem fixed since I wasn't able to connect to certain essential services whose credentials were linked to my Windows login, so I sent it to him despite my reservations.

My questions are:

1. Is requesting a password over a company messaging system an acceptable practice?

2. How should I have responded to this request?

3. Aside from resetting my password again, are there any other steps I should take (such as reporting the behavior)?

I care a great deal about security and I know that the upper management at my company does as well.

To address some of the comments/answers: I'm sure that the email was legitimate because it came from a company email address and directed to a company website that I already had bookmarked. (I've updated my password twice since this incident using the same method). The password had been updated everywhere except on my personal laptop. (This is why I couldn't log in without disconnecting from the network.) I'm also sure that the person I spoke to was from the IT department because his account was on the company domain and he was able to log in to my laptop remotely with admin privileges to fix the issue.

Answer 1

No it's not acceptable security practice for most companies. IT should have no need to know your new password, or your old one for that matter.

Reset your password again, if they skype again refer to your manager for approval before giving any passwords out over any medium.

Answer 2

This sounds very suspicious and personally I would CALL your IT help desk line and ask if the email is legit and if the person you spoke to was legit. IT help desk would NEVER ask for your password. Why would they when they can reset it? Doesn't make sense. It's sort of like the IRS calling you to ask what your social security number is, or your bank calling you to ask what your account number is. They'd have it, so why would you share what they already know?

As always never reset passwords via emails. Never share your password with anyone who claims otherwise. Always navigate to the website in question and use the password reset through that.

Answer 3

2. How should I have handled this situation?

I am only going to answer your second question.

For security reasons, you should never reply to a security request using a non-trusted channel.

1. For the email you received, you should have never clicked it. You should have opened the browser, typed in the url you always use instead, and tried to find a way to reset the password from there.

2. For the Skype request you received, you should have never replied to it using your new password. Instead, you should contact them by phone instead using the phone number you have for IT (and not any phone number that he provides to you through Skype).

3. Right now, this is still the only thing you need to do. You need to contact IT through a trusted channel. Either you call them on the phone, using a phone number you already know and that is already trusted by you, or you walk over to their desk tomorrow, ask to speak to the person who contacted you over Skype, confirm that this is the person who you gave your password to yesterday, and ask him what happened because you will most likely run into this same problem the next time you reset your password (which you'd like to do again, since you don't want a plain text copy of it to be on IT's computers).

And yes, I realize you said the first email wasn't a phishing email. That it wasn't a phishing email doesn't really matter. A good company that cares about security will regularly phish its own employees and generate reports on who took the bait, or not. Because that is really the only way to check whether security practices are being followed, or not.

And if your management really "cares about security", which is what you said. It's simply better to develop the reputation of being overly careful and overly paranoid over security than someone who usually cuts corners because of convenience or because he doesn't want to offend anybody.

Answer 4

IT SHOULD NOT ask you for your password. This is very bad security practice. Of course that doesn't mean that they WON'T.

I'd be very reluctant to give my password in response to an email or Skype message. How do I know the person at the other end is who they say they are? There are all sorts of tricks people can do to look legitimate. Most scam emails are very lame and easy to see through, but some are very sophisticated.

Just a few days ago I got an email claiming to be from Bank of America saying that there was suspicious activity on my account, they suspected someone had hacked my password, and I should click on this link and reset my password. The email looked very official, professionally-worded, had the Bank of America logo and all. I might have been fooled were it not for the fact that I don't have an account at Bank of America and never did.

I'd say, If you get such a message, call the IT department. Not using a phone number that's in the email, but look up the number. If they confirm that this message is from them, well, okay, you have an IT department with lame security measures, and how you deal with that is a whole different question.

Oh, by the way, I used to work for the Air Force. Every now and then the security people would call random personnel, say there was some sort of problem, and then ask for the person's password over the phone. If you gave them your password, they then yelled at you for giving your password over the phone, disabled your account, sent a memo to your boss saying you had broken security rules, and you had to write a letter basically begging for forgiveness before they would reactivate your account. I didn't fall for it, but several people in my department did. Because seriously, just because somebody on the phone SAYS he is from IT, how do you know he's not really a spy or a terrorist?