One for minnehaha B.

[rivka]

The clinic where I work two days a week refuses to give me login privileges to their network. Their rationale: I'm a contractor. Only employees may access the network, for security reasons. Okay.

We're not talking electronic patient charts. But I need to be able to check my e-mail from the clinic, and use the shared clinic computers to write up reports. Big signs over each computer require employees to log off when they're done. So without a login, I can't even access MS Word.

"You'll have to get someone to log in for you each time," the clinic director told me. Okay. So that's what I do.

The other day, one of the clinic employees came by as I was typing away and asked me, "Are you still using the computer as me?"

"No," I said. "I have to get someone to log me in each time."

"Well, I don't mind if you want to be me."

"I can't just log in as you," I explained. "I would need to know your password."

So she told it to me.

"Your password is the same as your login?" I asked.

"Yeah." She seemed surprised that I was surprised. "I think just about everybody's is."

So far I've confirmed that for the two other employees I've checked. This is the system, remember, where allowing official access to a contractor of three years' duration would be an unacceptable security breach. I believe that this is what's known as straining at a security gnat and swallowing a security camel.

Comments

[supergee.livejournal.com]

There are two kinds of password: the ones that make sense, so they can be stolen, and the ones that don't make sense, so you have to write them down and they can be stolen.

[papersky.livejournal.com]

There's the third option of ones that make sense to you but not to anyone else.

Say you had a pet iguana called Bosie, and it was the second iguana you'd had. You could have a password that was BosieGee2, (Gee, in this example being part of your surname) you have upper and lower case, and numerals, and you're not going to forget it either. It's also rather unlikely that people would hit on it in three tries. And if Bosie's real name is Boscastle IV, you probably call him lots of other pet names too, so you have years of options -- and if you run out, you can always get another iguana.

[supergee.livejournal.com]

I've managed to do one of those too.

[kightp.livejournal.com]

I'm fond of making up my own acronyms, with some l33t-style number-for-letter substitutions, to create passwords.

One of my old favorites (no longer in use on any account) was

PaAp1tA

for "Passwords Are A Pain In the Ass."

[lerryn.livejournal.com]

Sounds like one I used to use : 3 passwords in a row were rejected by a security program, so I typed in P@$$w0rd. This was accepted :)

[writingortyping.livejournal.com]

I'm fond of the substitute-a-number-for-a-letter trick, especially for those that have to change every X days.

Frex: I once had a cat named Benjamin. 1st iteration of password was B3njamin, second was Benj4min, third was Benjam1n. Whatever numbers look most like the letters they stand in for - makes it easier to remember that way (for me, at least - YMMV).

[minnehaha.livejournal.com]

Writing down passwords is fine. Write them down on a small piece of paper. You already know how to secure small pieces of paper. Put that small piece of paper in your wallet with all of your other valuable small pieces of paper.

The era of rememberable and secure passwords is over. Write them down.

B