Staff question - why do you have access to my password?

[Halfmad]

Have you considered doing what we've done and gone completely independant from the county for the curriculum side? As they sound like a shambles and a half and I would probably walk out of that place after a few weeks if I had no control.

 

I use to work for "Education I.T.", it wasn't perfect but it was aimed at making things work for the schools and not for I.T. but after a review they decided to merge us with the central unit and force us to work their way which is why I left after a year of stupid rules and policies which made no sense.

 

I'm hoping to very soon sort out all this although it would help if I had a technician so I wasn't having to work 7am - 4pm then take work home!

 

As far as data protection act etc is concerned I don't think that can be enforced, even when I was in council buildings people were writing their passwords on post-it notes and leaving them attached to the monitor! it's insane at times what people do with passwords, my own are changed regularly or are things that have no connection or meaning to myself (usually random keypresses that I memorise).

 

Thanks for all of the suggestions, it's nice to know that the way I'd like to work is the norm and that I'm not asking for anything out of the ordinary or that's utterly ridiculous. I.T. services frankly need a kick up the bottom

[GrumbleDook]

Howabout ... "I am a Network Manager and it makes little difference whether I have your password or not ... I can still change it to whatever I want, run recover tools on the servers to crack your password if I wanted and I could always just ask you and you tend to give your password to me anyway.

 

However, it is not my choice to work things this way ... it is done by people further up the chain at Central IT. If you have a problem then moan at them and not me!"

[tosca925]

:-)

[Friez]

Put it this way, if you didn't have access to their files, they can suffer when they 'accidentally' delete their entire home folder and come crying to you to restore the backup!

[mrforgetful]

Well technically if it was correctly setup security wise Backup Operators can restore files but not view them.

[Friez]

Since we're talking security. A friend of mine used to work for the MOD. He would drive into work every day and get greeted by an armed guard at the gate. Normally he would have to wave his security pass under the guards nose to get in, but he eventually figured the guard got so used to letting him in he started to get a bit creative.

 

He started to wave packets of fags, and even a packet of bacon under his nose and he didn't even blink.

 

That's security for ya!

[Lee_K_81]

I could always just ask you and you tend to give your password to me anyway.

 

Or i could just try: your child's name, your partners name, your car reg.

or ask one of the pupil's you've given it to.

[Heebeejeebee]

Or i could just try: your child's name, your partners name, your car reg.

or ask one of the pupil's you've given it to.

 

Just had a staff laptop in (not networked yet). Said member of staff has passworded their (local) account and not told us the password. So I click on password hint and it pops up a single word and - yep - you guessed it - it's the account password.

 

Needless to say it's changed now. I might even them them what it is.

 

HBJB

[Lee_K_81]

Schools would be a great place to work, and the network would be fine, if it wasnt for teachers and pupils.

[_Bat_]

Schools would be a great place to work, and the network would be fine, if it wasnt for teachers and pupils.

 

Hence our employment in said schools, to repair and minimise the damage

 

My headteacher walked past me in the corridor and spoke to me under her breath saying "what on earth possessed them to think there should be children in a school?"

[Guest Guest]

One day im gunna ask some teachers for their credit card number and pin. Wonder if they'll give me it? Some probably would!

 

I know the VAST MAJORITY of the teachers passwords, from art teachers internet to the deputy heads SIMS password. Not written down or owt but they are just so simple i cant help but remember them.

 

Its insane, and the teachers moan when a kid forgots his, or has his work deleted because his password was "password"

[_Bat_]

One day im gunna ask some teachers for their credit card number and pin. Wonder if they'll give me it? Some probably would!

 

I know the VAST MAJORITY of the teachers passwords, from art teachers internet to the deputy heads SIMS password. Not written down or owt but they are just so simple i cant help but remember them.

 

Its insane, and the teachers moan when a kid forgots his, or has his work deleted because his password was "password"

 

It's strange actually how trusting some of the teachers are. I'm not saying I'd ever abuse my position (because I certainly wouldn't), but on quite a number of occasions a teacher has told me their password for something I needed access to and then added "thats the password I use for everything". Knowing that some of these teachers in question -do- use internet banking and have a number of sensitive accounts elsewhere on the internet including their personal e-mail... it's quite surprising they told me that. I know that they know me, but at the end of the day, I'm just a colleague. How many of you would tell your colleagues your internet banking details or other sensitive information like that?

[gwendes]

Not me! I also think that storing lists of passwords potentially goes against the DPA and puts the sysadmin at risk - publishing something like that is going to have people blaming you for things that go wrong. To end users ignorance is bliss...

[GrumbleDook]

I am trying to make the connection between the DPA and storing passwords?

[_Bat_]

It's strange actually how trusting some of the teachers are. I'm not saying I'd ever abuse my position (because I certainly wouldn't), but on quite a number of occasions a teacher has told me their password for something I needed access to and then added "thats the password I use for everything". Knowing that some of these teachers in question -do- use internet banking and have a number of sensitive accounts elsewhere on the internet including their personal e-mail... it's quite surprising they told me that. I know that they know me, but at the end of the day, I'm just a colleague. How many of you would tell your colleagues your internet banking details or other sensitive information like that?

 

As a perfect example of this, today I had a meeting with a teacher and I needed her password to test something, so this is how the convo goes:

 

Me: Do you mind if you enter your password so I can log on as you?

Teacher: Sure. It's ****. Believe it or not, that's the password I have had since uni.

Me: Now you are going to tell me that's the password you use for everything?

Teacher: Yeah, it is. Internet banking, everything. Along with my date of birth, you could take over my life with that information.

Me: Thank-you very much!

 

Now all I have to do is find out her out her birthday on the MIS database and voila.

 

On one hand, it's nice to know they trust me enough with their life savings.. on the other hand, it's worrying who else they might have just given that information to. Any other teachers? Pupils? 8O

[Ric_]

@_Bat_: I don't like asking for passwords for exactly that reason. If I need to test something as a particular user I simply change their password making it evident that I have been into the account.

[PiqueABoo]

I am trying to make the connection between the DPA and storing passwords?

 

Principle seven.. data should be secure.. which arguably it is not if you leave a list of passwords lying around nearby (paper or electronic).

 

OTOH my long list of other people's admin passwords is kept lying around in an encrypted p/w storage utility db... and that db lives in a truecrypt volume together with misc. other sensitive docs... have hideously long non-dictionary passwords for both of them.

 

I don't want user p/ws to avoid the (unlikely) possibility of being more caught up in the mess when a user does something naughty and tries to blame it on someone who knows their password.

[VGeek]

I would agree with PiqueABoo storing passwords is a security risk and is not standard practice. Also having this information can cause problems with teachers. Teachers or any member of staff dont like to know another person has their password, subsequently they will ask you when they forget which can be tideous exercise to perform for members of staff regularly.

 

In the school I am currently a junior technician and passwords are not stored, but when a use forgets his or her password. A password change is forced out to alter the current password for the user. To me this seems like a more efficient way to handle passwords. We only know staff passwords when making configurations for laptops and workstations for mapping drives locally to that specific machine. This is because we have been made to enforce that passwords change monthly from a new directive, this is a right pain since users cannot remember there passwords.