Passwords

[DevilsAdvocate]

Hi all,

 

Do any of you store your pupil passwords on file at all? We've always disabled the pupils ability to change passwords and kept a record of every one we give out. Whenever they are forgotten (this is quite rare thankfully) they come see us and we provide them with it.

 

We use a piece of software that was coded by a member of staff who left some years ago and I need to decommission the server it sits on (it's a hosted Ruby on Rails app that is installed a UI-less Ubuntu setup...). I don't really want to lose the ability to store and look up the passwords as we currently do. I can export the DB no problem but was wondering if anyone had any software they themselves use in order to display the information and keep it up to date, as opposed to bunging it in an Access DB or something.

 

Any advice would be appreciated.

[Arreks]

Well in our situation, we wanted to avoid changing passwords in AD - so the students now use their Fronter (Atomwide/USO) passwords. They don't have the permission to change it.

[fairm010]

We used to but when the list was found in a pupils bag we put a stop to this. Now the children have permission to change their password and the teachers have access to a piece of software to change them if needed.

[IrritableTech]

We don't save users passwords, just create an initial one and force the user to change. I'd suggest it could put you in a vulnerable place for all kinds of reasons holding a database of current clear text passwords.

[elsiegee40]

So much depends on the age of the kids... now that you can do OU level password policies, you can let Reception Class have a 3 letter animal as their TOP SECRET password. Once the kids get older, passwords should have more complexity and by the time they are in year 5/6, most should be able to be allowed to change it themselves.

[LeMarchand]

Could you use something like Keepass or Password Gorilla to store the record?

 

Or use something to encrypt the file/folder containing the information and keep it in whatever format you like.

[DevilsAdvocate]

We don't save users passwords, just create an initial one and force the user to change. I'd suggest it could put you in a vulnerable place for all kinds of reasons holding a database of current clear text passwords.

 

 

The passwords aren't stored clear text in the DB. You only get the clear text version of the password after you login to the web based side of the application, which only we can do.

[IrritableTech]

If passwords are displayed in clear text either through a encryption reversal or any other means, they are still vulnerable. How can you be sure only you can log into the application? If you have a list of their passwords, and one of those users does something illegal for example. The first question the police will ask is who else had access to that password? If you haven't got access, you can't be implicated. If you have, well...

 

I don't like the term digital natives particularly, but pupils generally deal well with passwords I've found in my experience. They've probably remembered their parents smartphone pin before entering reception, as well as their mushi monsters login details.

 

I can't see any reason to have their password, just the ability to change their password.

[fairm010]

They've probably remembered their parents smartphone pin before entering reception, as well as their mushi monsters login details.

 

I can't see any reason to have their password, just the ability to change their password.

 

This was the reasoning I used when we moved over.

[DevilsAdvocate]

The general opinion then seems to be that storing them - encrypted or not - isn't the best idea.

 

With that in mind, to those who ask teachers to reset passwords for those who forget, how do you go about doing this?

[IrritableTech]

Ive used wisesofts password app. Fairly basic for teachers - you just need to delegate control to the right OUs. A free program, you just need to register to download.

 

http://www.wisesoft.co.uk/products/passwordcontrol/

[abaumber]

We set an initial password and force a change. All stored in AD. Pupils can change their own, and staff have access to a cut and locked down mmc console to change student passwords. Saves a lot of minor jobs.