Of course it's bad security practice. Nobody cares about the security implications. It's a necessary functionality and productivity hack. Managing access to re

Of course it's bad security practice. Nobody cares about the security implications. It's a necessary functionality and productivity hack. Managing access to resources is almost always a joke. Most systems do not give you ACLs to manage access to an account. When they do, the functionality is locked down to admins. When that isn't the case, the user interface is invisible or totally unintuitive. Basically, if the option is A) spend six months and half a million dollars to upgrade everything and train people, or B) only allow one person to check a single account, or C) share passwords, the choice is simple.