13

Generally, best practices in corporate IT security encourage employees to come up with unique and difficult-to-guess but easy-to-remember passwords.

In a general sense, is it acceptable in the workplace to have a password (not shared with others) that contains offensive language?

In response to @enderland 's comment, a password could be accidentally viewed over a shoulder, or in some cases corporate IT might have access to the text of a password and could feel tempted to "snitch" to management regarding the unprofessional password that they saw.

  • 6
    It may actually increase security, as you'll be far less likely to write down or share your password if you don't want them to know you wrote that. – David K Jul 18 '17 at 18:29
  • 18
    @DavidK these kinds of passwords may be less secure since offensive/sexual phrases are quite well represented in the top 500 most common passwords. While not exceptionally vulgar "pussy" is #5. – Erik Jul 18 '17 at 18:36
  • 5
    @Erik Also a good point. I suppose the security implications of using offensive phrases is better asked at Information Security :) – David K Jul 18 '17 at 18:40
  • 6
    Anyone seeing your password is a serious breach of security and seems significantly worse than even an extremely offensive password, but if you think an offensive word is hard to "guess", you don't really understand what makes a password good or how passwords are cracked (no, it's never / very rarely someone sitting behind a computer physically typing in guessed passwords). Replacing letters with similar numbers makes the password much harder to remember and not much harder to guess. – Dukeling Jul 18 '17 at 19:39
  • 4
    You might want to consider using a password with a more positive message, it might even change your life – 0xFEE1DEAD Jul 18 '17 at 21:30

12 Answers 12

32

In a general sense, is it acceptable in the workplace to have a password (not shared with others) that contains offensive language?

Sure, it's "acceptable".

Since (going along with your original assumption) nobody else should know your password, there is nobody to be offended other than you.

To restate the question in a more general sense, do principles of decency and decorum in the workplace trump IT security if using foul or offensive language would increase security?

I'm sure you realize you are posing a false dilemma here.

Most folks are able to come up with a perfectly secure password without resulting to childish, foul or offensive language. I'm sure you could too if you tried.

This might help you decide: Southwest Airlines Commercial

a password could be accidentally viewed over a shoulder, or in some cases corporate IT might have access to the text of a password and could feel tempted to "snitch" to management regarding the unprofessional password that they saw.

If you change your assumption this way, then I'm sure you know what you should be doing and there is little need for your question.

I know lots of IT folks who would "snitch" if they saw the passwords you originally wrote.

  • 4
    That video is great! – enderland Jul 18 '17 at 18:35
  • 3
    It's probably bad practice to ever have to share your password aloud, but makes a funny anecodte nonetheless ;) – enderland Jul 18 '17 at 18:37
  • 3
    "or in some cases corporate IT might have access to the text of a password" Storing passords in plain text? Yuck. – JAB Jul 18 '17 at 19:16
  • Most passwords are stored in a one way hash, so the only way corporate IT would see it is if they have keyloggers installed on your machines (really big brother territory there), or they have insecure systems and you might as well just use 'Password' – Bill Leeper Jul 18 '17 at 20:04
  • 2
    @BillLeeper I don't even know if "most" is accurate, in all of my recent jobs more of the passwords were stored in a recoverable format (whether that be encrypted, plain-text, or some piss-poor attempt at encryption) than not, which means in my experience most passwords are recoverable. – Der Kommissar Jul 18 '17 at 20:25
14

Is it acceptable? Well that really depends on how you look at the issue.


First thing first: passwords are supposed to be secret. This means other people should not have access to your password, and should not be able to see it, blah blah blah. (This has been covered by the other answers for the most part.) What people don't consider is what happens when you make a mistake (and you will). If you're in the IT world (especially Software Development / Programming / whatever you call yourself as a person who writes software for a living) you usually end up being a touch-typist. You learn to type fast, precisely, and without even needing to look at the screen or keyboard. (In fact, I typed the majority of this answer while reading some Android and Twitter documentation.)

What this means is that, while mistakes end up less frequent in terms of mistakes-per-time-typing (generally with our speed we gain accuracy) this ends up usually resulting in much more prevalent mistakes. That is: your mistake ends up blowing up extremely quickly. I cannot tell you how many times I've thought I was in a specific window (like a login window) to find out I'm typing my password into an Email I was formulating for a user, or into my "username" field because I missed the "tab". (I've even accidentally sent secured passwords to strangers via internet chats, I've changed them since, but it can happen.)

So when this happens, ask yourself: can I afford for this password to be accidentally sent to someone else?


Second, we type passwords in a lot, which means they become part of us. I used to use a passphrase that I'm going to post here as an example due to the fact that it's been retired from my usage for literally half a decade:

This is not my beautiful house!

This was literally the password I used to access certain systems that were, in fact, not in my home. These were systems that I needed to always remember access for, prevent brute-force attacks for, and avoid the possibility of someone reading over my shoulder. (It's hard to follow an 8-12 character password, it's harder to follow a sentence of a password.) Now, after typing this time-and-time again it literally became second nature, and that sentence (which, hilariously, is one of the lines from "Once in a Lifetime" by the Talking Heads) became the single fastest sentence I can now type.

So take one of these inappropriate passwords you came up with (which are also, conveniently, designed to require a lot of thinking power to process) and ask yourself: am I comfortable with burning this information into my brain and nature? You will literally be thinking about these things on a very frequent basis, and if the password is something you don't feel inappropriate thinking about, then I guess that answers that.


Third, I don't think you realize what the consequences are if someone does find this out. Especially in the area I live in, employer-employee relationships are 100% at-will, and I mean 100%. My employer can literally fire me for whatever they want that is non-discriminatory (they can't fire me for being a male, but if I start a hate-group against females then I'm fair game). Can you really afford to take such a risk? (This is just for completeness, other answers already covered this.)

I once had a coworker whose password was "F---myj0b", literally. (He loved it: he bragged a lot about that password.) One of the managers overhead this bragging, and several minutes later the coworker was walked out of the building and ordered never to return. Is that a risk you're willing to take?


Tl;dr

Risk it if you want, but don't say we didn't warn you.

  • 3
    I really like this answer and upvoted it. However, you should remove that bit about hate crimes. Generally a hate crime has to involve both hate and a crime, which a password generally isn't. Maybe if the country has a law against hate speech, but even that's a stretch. Your overall point is correct though, in that a password describing a hate crime would be even more poorly received than a password that simply denigrated your job, even if it didn't lead to legal consequences. – Kat Jul 18 '17 at 23:16
  • @Kat Fair enough - bit on that removed. – Der Kommissar Jul 18 '17 at 23:17
  • 3
    Had that coworker loved and bragged a lot that his password was 123456 or in fact anything else, he still ought to have heard from management as well – Hagen von Eitzen Jul 19 '17 at 3:20
  • 3
    Yes, and furthermore it might be a bit misleading to use that as an example here, since we don't know if the firing was because of the content of the password or because he was sharing it so liberally. – David Z Jul 19 '17 at 6:16
  • "I typed the majority of this answer while reading some Android and Twitter documentation." - stop being silly. Do you really believe people can read and write at the same time? – BЈовић Jul 19 '17 at 6:33
9

Sure, if you work in an office where no one ever asks you for your password for any reason, that should be fine. A well-managed IT department will never do this but will instead ask you to temporarily change your password if they need to work on your computer. However, in my company, the IT department has asked me for my password and I'm glad I didn't make it something lewd.

tl;dr: It probably doesn't matter, but why take the risk?

  • 3
    We once enjoyed listening to a project manager trying to tell IT a laptop password over the phone without them realising he was using Password1. Capital P... as... swo... rd... 1. – MattP Jul 18 '17 at 20:51
  • Affable why hasn't your CTO been fired – Neuromancer Jul 18 '17 at 22:50
  • @Neuromancer He actually left shortly thereafter. Not sure if he quit or was "asked to leave" but he was replaced by someone much more competent. – AffableAmbler Jul 18 '17 at 23:43
5

In theory it is salted so IT cannot see it and you should not need to share with others but stuff happens. What if you cannot get into work and someone needs on you computer. Why take the risk?

Incorrect password attempts do often get logged.

I missed my password twice and typed in a swear string out of frustration and I got talked to about it.

  • POOR assumption here about 'salting'. I worked for a place that stored passwords in plain text so the admins could be called to help a user 'recover' a password. There are some very backwards systems out there still. – Xavier J Jul 18 '17 at 19:15
  • 2
    @XavierJ I made NO such assumption. I said "In therory". – paparazzo Jul 18 '17 at 19:17
  • 2
    @XavierJ NOT going to argue with you. – paparazzo Jul 18 '17 at 19:21
  • 4
    >Incorrect password attempts do often get logged. If they salt their passwords i hope they're not logging 'incorrect' passwords in plain text. - 1: pssword1 : failed - 2: pasword1 : failed - 3: success! Goodness i wonder what his password might be? There's other issues with this but i think they're fairly obvious. – Shadetheartist Jul 18 '17 at 21:30
  • 1
    @Shadetheartist hope all you want, but surely it happens sometimes, and you probably have no way of knowing. – Kat Jul 18 '17 at 23:18
5

No. Just... no.

There is absolutely no reason to have it vulgar or offensive, so people better pick something that is not. The chance of anything biting you in the arse regarding the meaning of your password is extremely slim, however, if it does - it is going to be embarrassing.

I will conclude with a story. A friend of mine thought it hilarious to select "pussy" to be his password. Over the years, they implemented new rules, you have to update the password, cannot pick an old password, has to have an alphanumeric char in it. So, predictably "pussy1" was followed by "pussy2" and so on. One day his computer crashes and he needs assistance to fix it. IT wants to wipe it clean, but since my friend so cleverly has been avoiding using the online folder for stuff (everything on C:) he desperately needs it repaired. So, the IT guy says "I need your password to log on to your user" - my friend had to submit his "pussy15" password ("pussy15" implies a certain level of... pedophilia - at least in my native language it does - the 15 is very easily understood as age) Fortunately there were no other consequences than IT people generally acting weird around him.

Don't do it.

  • 1
    That's a good story. He should have done a "pussy0" > "pussy1" > "pussy0" bit switch type deal. But that would imply a level of intelligence. I'm jk he's probably a great guy to be around. – Shadetheartist Jul 18 '17 at 21:33
  • The IT department has ways to get at your friend's files without needing his password. – alroc Jul 18 '17 at 21:36
  • @Shadetheartist most companies keep a history, you can't just reuse old passwords either. In my current company you can't repeat a password you had in the last year, and you have to switch every 2 months. He could avoid the 15 but would need to count up to 5 to start again. – CodeMonkey Jul 19 '17 at 7:02
4

Here is a second hand story that should convince you not to have a offensive password....

A senior staff member of a company was on a screen sharing meeting demoing a project. During the course of the demo he had to type his password. As it happened someone instant messaged him at the same time that he was expecting the password prompt to appear. He typed his offensive password into the instant message window by mistake.

So not only did the message go out the person messaging him, it was also viewed by many senior people in the company.

  • This seems like complete user stupidity to me. If you are projecting or sharing your screen, you should not have anything else, especially messaging programs, running. Also, I'd unshare my screen if I had to type a password. There is a certain amount of discipline a user should use...its a matter of professionalism...just my opinion. – bluegreen Jul 19 '17 at 14:13
2

It is a password, it is a personal choice. Do it if it is your taste.

But I would be reluctant because:

1) Depending of your personality, entering multiples times "I hate my job" or whatever may affect your psychology in a good or bad way;

2) Depending of your job and your company policies, there can be an exceptional moment where half the network is down because of a ransomware virus, so the admin cannot replace your password, you are away of the office, a co-worker call you because you have a specific application installed your computer or some code that compile only on your machine to fix production. And because you do not have any computer with an internet connection on hand, it is just simple to give them your password to fix production and replace your password when you will be back;

  • 4
    You do not, under any circumstaces and for any reason, ever, give your password voluntarily to anyone else. I think #2 in your answer is an unnecessary point that should not be considered. (I otherwise agree with #1.) – xxbbcc Jul 18 '17 at 18:55
  • @xxbbcc Let say a customer of my agency is down while I am away, it cost them 40,000$ per hour because their production is down and the solution is on my computer, they just have to double-click on an icon to recompile/redeploy a package because all the dependencies are installed on my machine, I should answer to my boss: wait for my return or find a way to replace my password? – Sebastien DErrico Jul 18 '17 at 18:57
  • 4
    There's something seriously wrong with that company in your example. No one should ever need your password for mission-critical work. – xxbbcc Jul 18 '17 at 18:59
  • 1
    @xxbbcc Talk to Paparazzi, he seems to share a similar experience :) – Sebastien DErrico Jul 18 '17 at 19:08
  • @SebastienDErrico you should not have a build that depends on your machine in the first place. If this is a common occurence you should think about setting up a build-server, not sharing passwords. – CodeMonkey Jul 19 '17 at 7:07
2

As answered previously, the fact that it is acceptable or not depends on your situation: if someone has a chance to access this password, then you are taking a risk.

A workaround is to make the password hard to decode. For instance, a widespread password generating technique is to take the first letters of each word of a sentence. So the offensive sentence:

I hate this mother f***ing Boss!

gives the password

IhtmfB!

Pretty hard to tell what it really means, and kind of secure. But you can still enjoy saying this sentence in your head every time you type your password.

If you take some time to think about it, you can also prepare a decent explanation, in case someone asks where your cryptic password comes from. With this exemple:

I have to meditate for Buddha!

will make you pass for a master of zen.

0

Since you are on record as having asked this question, you should not. Anyone else is a different kettle of fish. There two reasons why you should not: one political and one security.

Since we must assume anything posted on the internet will get back to your boss, there is a better chance your boss will take a closer look at your language.

Secondly there are fewer obscene words in a given language than works that are not, which means that anyone trying to hack your password (again since you asked about it) will start with the obscene words to try to save time.

0

From https://www.worktime.com/usa-employee-monitoring-laws-what-can-and-cant-employers-do-in-the-workplace/

Q: Do employers have the right to monitor keystrokes, e-mail content and screens? A: Yes, employers have this right.

It then goes on to expound that yes, employers in the US have the right to record every keystroke you type on employer owned equipment. My former employer took this further, if you accessed personal E-mail from work, they could, and would also record that access information and use it to access your personal accounts in search of company private information and successfully defended themselves in a wrongful termination suite from information gained this way.

If it is typed on employer owed assets, the employer owns it and you have zero right to it being private because you are no longer the owner, they are. This absolutely includes their being able to back door access your company passwords if they so choose. I was forced to write up an employee over this issue and their choice of passwords they thought was funny and undetectable. They were incorrect.

  • At the same time, choosing such a password is a very good method to measure an employer's or colleagues'.... snooping. Not that it is snooping, from a legal perspective. But snooping. – Weckar E. Jul 19 '17 at 0:19
  • Interestingly, there are not many employers for whom using those sniffed creds to access your personal email would be legal. In the US it's really only a couple of three letter agencies... – Rory Alsop Jul 19 '17 at 7:56
-1

Short answer, I don't recommend it. If a co-worker sees you typing it in, next thing you know you are out the door for 'harassment'.

On the other hand, if your IT has passwords stored as plain text, and THEY saw it and you got fired, they could probably end up getting sued, because storing unhashed passwords in plain text or SQL is a reckless security practice for a system that probably has sensitive personal information on it such as your social security number and etc.

  • Why the scare quotes around "harassment"? If the password contains a racial/sexual/etc slur, then in the scenarios posted by other posters - accidentally broadcasting the password in chat, for example - it very much is harassment. – Julia Hayward Jul 19 '17 at 5:44
  • Because if it is vulgar, but NOT racist, sexist, etc, AND NOT directed to any individual or group (Example a password of f**k1234). This would not be used in a context that would reasonably deemed as harassing anyone, however, it may violate the 'harassment policies' of many companies. If someone does make a lewd comment or act intended to be viewed by another person, this IS harassing, but having a vulgar password is not, but is likely to be misconstrued as such by management who are paranoid of frivolous lawsuits. – Davidt Jul 19 '17 at 14:10
-2
  • In theory, it is up to you.
  • In theory, nobody can see it, and it doesn't harm anybody.

But:

There are sometimes cases as others know a password. For example, your boss calls on your phone, that he must show something to a wannabe customer now, but forget that database password.

In theory, it shouldn't ever happen, but practice can be different.

You likely won't ever get into such a situation that you have to spell to your boss, he can log in with a curse word.

  • 1
    What are you actually saying? – Lilienthal Jul 19 '17 at 6:38
  • @Lilienthal That there is a small chance, that he needs to share his password with others. For example, his boss needs access to something quickly in a very urgent case and the OP is offline. And, in these cases, it can result an awkward situation. – Gray Sheep Jul 20 '17 at 20:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.