3 ms·

A proper policy would’ve been to not have any human look at a user’s password and just email them a warning about their weak password. A password should be cons

by bakul 7y ago

A proper policy would’ve been to not have any human look at a user’s password and just email them a warning about their weak password. A password should be considered a PPI (personal, private information) and off limits to others, no matter how creepy (exception being a legal warrant). These days you might gotten in trouble!

jedberg 7y ago
Agreed. That's why if I were doing it today, I would just shut off the account after the second warning. Although I don't think it's PII if it's all internal company data, especially if it is known that IT will crack your password.
- bakul 7y ago
  A password is supposed to be very hard to guess by others but not so hard for you to remember so it can be said to be PII! And no, it is not assumed that IT will crack your password. Because how do you know how far IT would go to crack your password and how do you know they are not looking at your data as well? Employee/company officers' email may contain data that could be highly sensitive and something IT should not be looking at.
  - laughinghan 7y ago
    it is not assumed that IT will crack your password At this company, it was public knowledge that IT will crack your password. At the vast, vast majority of companies, it's public knowledge that they are looking at your data and email as well. If you are under the impression that your employer doesn't, you should double-check because you are almost certainly wrong.
- ben509 7y ago
  It shouldn't be personal identifiable information. But PII asks what that information is, not what it should be. Given that people reuse passwords or put things like DOB in their passwords, a conservative classification should treat passwords as PII. If a company is cracking passwords, it should stop that to protect IT from liability. Example: someone reuses a password, and an IT employee sees that during a cracking operation, and that person's account by chance is hacked, now that person can accuse IT of misusing the password. Maybe those disclaimers will protect them, but it's always smarter to avoid liability entirely than rely on fine print that a court can disregard.

by bakul 7y ago

jedberg 7y ago

Agreed. That's why if I were doing it today, I would just shut off the account after the second warning. Although I don't think it's PII if it's all internal company data, especially if it is known that IT will crack your password.

bakul 7y ago
A password is supposed to be very hard to guess by others but not so hard for you to remember so it can be said to be PII! And no, it is not assumed that IT will crack your password. Because how do you know how far IT would go to crack your password and how do you know they are not looking at your data as well? Employee/company officers' email may contain data that could be highly sensitive and something IT should not be looking at.
- laughinghan 7y ago
  it is not assumed that IT will crack your password At this company, it was public knowledge that IT will crack your password. At the vast, vast majority of companies, it's public knowledge that they are looking at your data and email as well. If you are under the impression that your employer doesn't, you should double-check because you are almost certainly wrong.
ben509 7y ago
It shouldn't be personal identifiable information. But PII asks what that information is, not what it should be. Given that people reuse passwords or put things like DOB in their passwords, a conservative classification should treat passwords as PII. If a company is cracking passwords, it should stop that to protect IT from liability. Example: someone reuses a password, and an IT employee sees that during a cracking operation, and that person's account by chance is hacked, now that person can accuse IT of misusing the password. Maybe those disclaimers will protect them, but it's always smarter to avoid liability entirely than rely on fine print that a court can disregard.