4 ms·

Just to be clear, I agree, and I think what the person I'm replying to did is totally kosher. But I just think the fact that my password is private should not j

Just to be clear, I agree, and I think what the person I'm replying to did is totally kosher. But I just think the fact that my password is private should not just be within technical limitations. If you find my password is "hurtmedaddy" I have a reasonable expectation to privacy about that beyond what SHA can and can't protect me from, and I would hope it's not showing up in some weekly report to be shared with IT. A hacker might find it anyway, but certainly my boss certainly shouldn't have to. edit: And back to technical concerns - someone knowing my password leaves a hard-to-audit window in which I am even less secure. Force-resetting the password in automation instead of revealing it would be better. Sharing it more widely before the problem is fixed increases the risk.

kelnos 7y ago
I personally would not have any expectation that my work passwords are private. I would expect, say, Google to keep my password private, and have internal controls around not letting people see my password, or leak it to the outside. But I'd have no expectation that my boss or IT department didn't have the ability to find out what my password was if they wanted. For strength of security, I really hope they're hashing passwords, but it's well within their rights to try to crack that hash, or log my password as I send it to a webserver the company controls if they want/need to for any reason. As an imperfect analogy, let's say I write something in a plaintext document, a big rant about how I'm pissed off at one of the executives, and in that rant I make a (not serious, but certainly worrisome) threat against the exec. I foolishly decide to store this document in my company-provided storage on their servers. (Or let's say I stick it in Google Docs in the company's GSuite account.) Should I have a reasonable expectation of privacy there? I'd say no. I get that some might have the feeling that passwords are different because their entire function is to be private. From a security perspective, yes, I agree. But form a "what you do on company property/resources is visible to the company if they want it to be" perspective, I don't.
- TallGuyShort 7y ago
  That's not unreasonable, but as you said the point is to be private - it's definitely not what people expect. If they were going to try crack my passwords and look at them when they're cracked, I'd want a memo, to say the least.

kelnos 7y ago

I personally would not have any expectation that my work passwords are private. I would expect, say, Google to keep my password private, and have internal controls around not letting people see my password, or leak it to the outside. But I'd have no expectation that my boss or IT department didn't have the ability to find out what my password was if they wanted. For strength of security, I really hope they're hashing passwords, but it's well within their rights to try to crack that hash, or log my password as I send it to a webserver the company controls if they want/need to for any reason. As an imperfect analogy, let's say I write something in a plaintext document, a big rant about how I'm pissed off at one of the executives, and in that rant I make a (not serious, but certainly worrisome) threat against the exec. I foolishly decide to store this document in my company-provided storage on their servers. (Or let's say I stick it in Google Docs in the company's GSuite account.) Should I have a reasonable expectation of privacy there? I'd say no. I get that some might have the feeling that passwords are different because their entire function is to be private. From a security perspective, yes, I agree. But form a "what you do on company property/resources is visible to the company if they want it to be" perspective, I don't.

TallGuyShort 7y ago
That's not unreasonable, but as you said the point is to be private - it's definitely not what people expect. If they were going to try crack my passwords and look at them when they're cracked, I'd want a memo, to say the least.