1

I got an email saying my password would expire in a few days, so I clicked on the link in the email and updated it. After doing so, I realized I could no longer log in to my computer, except by disconnecting from the network and using my old password. I immediately opened a support ticket. The next day, I was working from home, and someone from IT finally contacted me over Skype messenger. He asked me what my new password was. I was desperate to get the problem fixed since I wasn't able to connect to certain essential services whose credentials were linked to my Windows login, so I sent it to him despite my reservations.

My questions are:

  1. Is requesting a password over a company messaging system an acceptable practice?
  2. How should I have responded to this request?

  3. Aside from resetting my password again, are there any other steps I should take (such as reporting the behavior)?

I care a great deal about security and I know that the upper management at my company does as well.

To address some of the comments/answers: I'm sure that the email was legitimate because it came from a company email address and directed to a company website that I already had bookmarked. (I've updated my password twice since this incident using the same method). The password had been updated everywhere except on my personal laptop. (This is why I couldn't log in without disconnecting from the network.) I'm also sure that the person I spoke to was from the IT department because his account was on the company domain and he was able to log in to my laptop remotely with admin privileges to fix the issue.

  • 4
    "I clicked on the link in the email and updated it" Maybe you should discuss that with your IT... – Edgar Mar 28 '18 at 0:24
  • 7
    I have never heard of someone needing your password to fix a password issue. The default response is always to reset it – SaggingRufus Mar 28 '18 at 10:14
  • 2
    This is not ok from a security point of view. Nobody should know your password, it should be one-way encrypted using a hash algorithm. – Cris Mar 28 '18 at 11:39
  • 5
    Your IT department should never ask for your password via any method. This is a violation of information security policy in every environment I've worked – alroc Mar 28 '18 at 13:39
  • 1
    This question reeks of company specific policy/culture and I'm afraid the answers will focus more on best practice. – dwizum Mar 28 '18 at 15:47
27

No it's not acceptable security practice for most companies. IT should have no need to know your new password, or your old one for that matter.

Reset your password again, if they skype again refer to your manager for approval before giving any passwords out over any medium.

  • 2
    And even if your manager approves, don't give it over Skype or any medium that will retain it. – Seth R Mar 28 '18 at 3:34
  • 5
    refer this to your company's security team not your manger. – Neuromancer Mar 28 '18 at 10:02
  • I agree with @Neuromancer, based on what I know about my manager, he would probably be more concerned about me getting back to work as quickly as possible than following security best practices. Otherwise, good answer. :-) – AffableAmbler Mar 28 '18 at 13:41
6

This sounds very suspicious and personally I would CALL your IT help desk line and ask if the email is legit and if the person you spoke to was legit. IT help desk would NEVER ask for your password. Why would they when they can reset it? Doesn't make sense. It's sort of like the IRS calling you to ask what your social security number is, or your bank calling you to ask what your account number is. They'd have it, so why would you share what they already know?

As always never reset passwords via emails. Never share your password with anyone who claims otherwise. Always navigate to the website in question and use the password reset through that.

  • Thanks for the answer. The guy was definitely legit. He was able to fix the problem in about 10 minutes once he figured out what was going on. The person who set up my computer initially didn’t assign it to the right workgroup or something like that. We get emails approximately every two months reminding us to reset our passwords. It always comes from the same address. – AffableAmbler Mar 28 '18 at 1:20
  • I’m guessing the reason he asked is so he could set it back to what I wanted it to be when he was finished. I don’t think he was trying to do anything malicious. Mostly just wondering if it’s something worth reporting or if I should just let it be. – AffableAmbler Mar 28 '18 at 1:26
  • 8
    Not quite @Dan, a good IT department should not have your password in clear text and therefore don't "know" it. They can reset it, but they shouldn't be able to see the actual characters unless you are using a known or easily guessed password. – Jay Mar 28 '18 at 1:55
  • 1
    I think you were right to have reservations, as it's good security practice. You know the IT guy in this case was legit. If you have doubts in the future give the IT team a call. I'd never ask for a password, I'd just reset it for you and give you the new password. It sounds like the IT guy has gone above and beyond in this instance to help you out, however probably shouldn't have done. Keep on your toes but I don't see any benefit to reporting this incident as the IT guy may have been wrong to handle it the way he did. – AdzzzUK Mar 28 '18 at 8:05
  • 1
    Downvote due to the line about knowing the password, as @raterus has said passwords are never stored in plain text as this is bad practice, instead they are hashed. Rest of answer is perfectly sound. – Connor Mar 28 '18 at 14:06
2
  1. How should I have handled this situation?

I am only going to answer your second question.

For security reasons, you should never reply to a security request using a non-trusted channel.

  1. For the email you received, you should have never clicked it. You should have opened the browser, typed in the url you always use instead, and tried to find a way to reset the password from there.

  2. For the Skype request you received, you should have never replied to it using your new password. Instead, you should contact them by phone instead using the phone number you have for IT (and not any phone number that he provides to you through Skype).

  3. Right now, this is still the only thing you need to do. You need to contact IT through a trusted channel. Either you call them on the phone, using a phone number you already know and that is already trusted by you, or you walk over to their desk tomorrow, ask to speak to the person who contacted you over Skype, confirm that this is the person who you gave your password to yesterday, and ask him what happened because you will most likely run into this same problem the next time you reset your password (which you'd like to do again, since you don't want a plain text copy of it to be on IT's computers).

And yes, I realize you said the first email wasn't a phishing email. That it wasn't a phishing email doesn't really matter. A good company that cares about security will regularly phish its own employees and generate reports on who took the bait, or not. Because that is really the only way to check whether security practices are being followed, or not.

And if your management really "cares about security", which is what you said. It's simply better to develop the reputation of being overly careful and overly paranoid over security than someone who usually cuts corners because of convenience or because he doesn't want to offend anybody.

1

IT SHOULD NOT ask you for your password. This is very bad security practice. Of course that doesn't mean that they WON'T.

I'd be very reluctant to give my password in response to an email or Skype message. How do I know the person at the other end is who they say they are? There are all sorts of tricks people can do to look legitimate. Most scam emails are very lame and easy to see through, but some are very sophisticated.

Just a few days ago I got an email claiming to be from Bank of America saying that there was suspicious activity on my account, they suspected someone had hacked my password, and I should click on this link and reset my password. The email looked very official, professionally-worded, had the Bank of America logo and all. I might have been fooled were it not for the fact that I don't have an account at Bank of America and never did.

I'd say, If you get such a message, call the IT department. Not using a phone number that's in the email, but look up the number. If they confirm that this message is from them, well, okay, you have an IT department with lame security measures, and how you deal with that is a whole different question.

Oh, by the way, I used to work for the Air Force. Every now and then the security people would call random personnel, say there was some sort of problem, and then ask for the person's password over the phone. If you gave them your password, they then yelled at you for giving your password over the phone, disabled your account, sent a memo to your boss saying you had broken security rules, and you had to write a letter basically begging for forgiveness before they would reactivate your account. I didn't fall for it, but several people in my department did. Because seriously, just because somebody on the phone SAYS he is from IT, how do you know he's not really a spy or a terrorist?

  • But what if you were under attack, the person operating certain control / communications system was killed or injured and you were the only one with access at that moment and they needed to relay important information to the troops? – Jack Mar 29 '18 at 1:01
  • @jack Fortunately, I spent most of my time at Wright Patterson Air Force Base in Ohio. We had a perfect record: No enemy aircraft have ever gotten past our base. – Jay Mar 29 '18 at 4:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.