If someone asked you to email them your username and password, you’d think it was rather strange, yes? So, imagine my surprise when our corporate intranet web page announced:
“If you are a [special service] user and you wish to use your account over the Easter holidays, please e-mail [Tech Support] with your username and password urgently.”
😯
Of course you’ve let the powers that be know this is a “bad thing(tm)”, never mind a breach of security policy – HQ do have a written policy which states password is yours and should never be given to anyone.
Of course this *could* be a ploy to see who’s daft enough to divulge such info and slap them when they do….??
PermalinkOf course this *could* be a ploy …
AP and I were discussing this last week and trying to figure out what proportion of the staff in our domain would actually send us their password. “Quite a few” was the consensus. I would *really* like to try this, but the ethics of the situation are rather fuzzy.
Having said that, it would be trivial to sniff the network and pull all our users’ passwords out … 🙂
Permalink