One for minnehaha B.

[rivka]

The clinic where I work two days a week refuses to give me login privileges to their network. Their rationale: I'm a contractor. Only employees may access the network, for security reasons. Okay.

We're not talking electronic patient charts. But I need to be able to check my e-mail from the clinic, and use the shared clinic computers to write up reports. Big signs over each computer require employees to log off when they're done. So without a login, I can't even access MS Word.

"You'll have to get someone to log in for you each time," the clinic director told me. Okay. So that's what I do.

The other day, one of the clinic employees came by as I was typing away and asked me, "Are you still using the computer as me?"

"No," I said. "I have to get someone to log me in each time."

"Well, I don't mind if you want to be me."

"I can't just log in as you," I explained. "I would need to know your password."

So she told it to me.

"Your password is the same as your login?" I asked.

"Yeah." She seemed surprised that I was surprised. "I think just about everybody's is."

So far I've confirmed that for the two other employees I've checked. This is the system, remember, where allowing official access to a contractor of three years' duration would be an unacceptable security breach. I believe that this is what's known as straining at a security gnat and swallowing a security camel.

Comments

[minnehaha.livejournal.com]

Writing down passwords is fine. Write them down on a small piece of paper. You already know how to secure small pieces of paper. Put that small piece of paper in your wallet with all of your other valuable small pieces of paper.

The era of rememberable and secure passwords is over. Write them down.

B