My favourite was at one of the companies I worked for. The admin decided that users are not to be trusted to choose their own passwords and so you had to mail t

My favourite was at one of the companies I worked for. The admin decided that users are not to be trusted to choose their own passwords and so you had to mail the admin to generate the password for you which you then could not change on your own -- you had to mail him again. The password had to be changed every month and an email would go to entire company to change passwords before the guy goes on vacation. I would like to think we progressed a bit but recently I worked for another company which required that we use our company domain password to log in to test linux servers. The issue is that everybody has root access on those servers. I implored that it is not safe and there should be separate accounts to access those servers but of course nobody would hear it. So I wrote a script which intercepted all logins and passwords of people logging in to our test servers and then sent to the manager responsible for it. Well... they wanted to fire me for "hacking" their servers and I had to explain to them that once you have root on a server there really is not much they can do to prevent me from stealing passwords. The end was they did not understand anyway and I was barred from accessing test environments. They also changed the linux distribution and "hardened" it because the old one "must had security vulnerabilities". Fortunately, I soon changed the job again.