Recommended Posts

My Supervisor (not the big boss), has decided that it would be in the companies interest to keep an up to date log of EVERYONES username/password for the computers (joining the sbs server).

The reasons for it is that if an important email is sent to someone, or someone has an important file on their PC then we can still get to it in an emergency.. which we could still do anyway.

Is there any data protection or privacy that stops this from happening? My supervisor aruges that its all business use and not personal so there should be no privacy.

Im strongly against this, there is no way i want a list of everyone?s passwords and there is no way im going to give anyone my password.

OF course this list would be kept only accessible by one or two managers.

Any have any suggestions or recommendations?

Adam

Link to comment
https://www.neowin.net/forum/topic/560851-privacy-issues/
Share on other sites

Ridiculous. A well maintained environment would need no such policy. Access to passwords should be one-way only. Admins can reset them, but not see them. In an "emergency", the network admin should already have rights to:

a) Reset the specified users password

b) Be a local admin and be able to interrogate the machine / accounts

c) Be a domain admin as be able to interrogate the machine / accounts

Moreover, emails and work files should not be stored locally but on a relevent server (exchange/fileserver/sharepoint).

As much as the computers are a company resource, a lot of people use passwords that are reflective of other passwords they may use elsewhere. There is No reason for anyone to know passwords.

My CTO has access to anything I do/send/post/save but has no need for my password.

Link to comment
https://www.neowin.net/forum/topic/560851-privacy-issues/#findComment-588556752
Share on other sites

If you ask me your supervisor doesn't understand exactly how networks work. As an admin you'll be able to access anyone else's files and email anyway, and be able to reset their password should there be an emergency. Personally I'd refuse to tell my password, its nobodies business but my own.

Link to comment
https://www.neowin.net/forum/topic/560851-privacy-issues/#findComment-588556905
Share on other sites

My Supervisor (not the big boss), has decided that it would be in the companies interest to keep an up to date log of EVERYONES username/password for the computers (joining the sbs server).

The reasons for it is that if an important email is sent to someone, or someone has an important file on their PC then we can still get to it in an emergency.. which we could still do anyway.

Is there any data protection or privacy that stops this from happening? My supervisor aruges that its all business use and not personal so there should be no privacy.

Im strongly against this, there is no way i want a list of everyone?s passwords and there is no way im going to give anyone my password.

OF course this list would be kept only accessible by one or two managers.

Any have any suggestions or recommendations?

Adam

I take it you don't already have some sort of network use policy in place stating that you won't give out your password to anyone? You really should tell your boss that as a sys admin you already have the ability to get into everyone's account and that having everyone's password is a serious security risk.

Link to comment
https://www.neowin.net/forum/topic/560851-privacy-issues/#findComment-588557081
Share on other sites

Absolutely, as already mentioned passwords should be strictly one way.

If need be, the Admin can reset a users password to a temporary one to gain access to the account/files if they don't have already.

But wanting to keep a list of all user name/passwords is easily a breach of privacy, and a half-baked idea anyway.

What happens when the list falls into the wrong hands? Or when a user changes his/her password.

The very fact that the "supervisor" is requesting this, makes me wonder how he/she got the job.

Link to comment
https://www.neowin.net/forum/topic/560851-privacy-issues/#findComment-588563449
Share on other sites

Remind your supervisor that him knowing everybody's password does two things:

a) Renders your AUP useless.

b) Makes him a target.

If a user was ever accused of doing something they shouldn't then they would be in a position to simply accuse you AND/OR your supervisor of doing it since you know their password and can log in as them.

Link to comment
https://www.neowin.net/forum/topic/560851-privacy-issues/#findComment-588565601
Share on other sites

It's realy not a good idea to put yourslef in that position. I used to give myself access to everyone exchnage boxes but stopped doing that now cos someone accused me of spamming, thanks to audit logging i proved it wasn;t me but i now only gain access to other peolple emails when asked by the person in charge, and only while they're present.

Having the passwords shouldn't matter with regards to Data protection but its what you do with them that could cause trouble!

Link to comment
https://www.neowin.net/forum/topic/560851-privacy-issues/#findComment-588567716
Share on other sites

I would have to say there was one thing I didn't see anyone of you state in this email. As a consultant and IT manager I've had to deal with this in the past and have spoken with several peers. It is common to hear this type of request coming from a company looking for either a) to much control or b) paranoid (be it legal or personal reasons) and c) that do not have a clear understanding of the law and recent court standings.

This boils down to a privacy issue. The information, as you have found through this post, is readily available to anyone with administrative access to the systems in question. Be it a file, data table, email, or many other items; this is the point of Administrative Access.

Here is something to think about, please keep in mind it is only from the Federal Perspective and does not include potential local statutes you may have to deal with:

"The Electronic Communications Privacy Act (ECPA) (18 U.S.C. ?? 2510-20; 2701-2711), is the only federal statute relevant to claims of workplace invasions of privacy by electronic means. The ECPA prohibits (1) unauthorized and intentional "interception" of wire, oral, and electronic communications during the transmission phase, and (2) unauthorized "accessing" of electronically stored wire or electronic communications.

For purposes of interpreting the Act, it is important to note that an e-mail is an "electronic communication" as that phrase is defined in ? 2510. In the specific context of e-mails, it is also important to determine whether an employer "intercepted" the e-mail while it was being transmitted, or whether he/she "accessed" it minutes, days, or weeks after it was stored in an employee?s computer. This distinction is important because different penalties apply:

? Section 2701 prohibits the unauthorized access of an e-mail that is stored in a computer. A violation of ? 2701 subjects the violator to a fine of up to $10,000 and/or a sentence of up to one year in prison.

? Section 2511, on the other hand, prohibits the interception of an e-mail while the e-mail is being transmitted, and subjects the violator to penalties of up to a $10,000 fine and/or up to five years in prison.

The ECPA contains two exceptions that are pertinent to e-mail communications. First, under the system provider exception, the prohibitions on the interception, disclosure, or use of electronic communications do not apply to conduct by an officer, employee, or agent of a provider of electronic communication services if the interception occurs during an activity necessary to the rendition of the service or to the protection of the rights or property of the provider."

For example, a Massachusetts court found that reviewing employees' mail using a supervisor's password violated state law against "unreasonable, substantial or serious" interference with privacy (Restuccia vs. Burk Technology).

Please note here that I only focused on email. The ECPA is far reaching as well as the state and local statutes. Some states even have vague ties in their state constitutional amendments. You'd have to check on your local and state laws to be sure.

In the end it comes down to having a sound monitoring policy in place. One in which everything is spelled out, is signed by the employee and counter-signed by the IT dandand HR. Remember, even though the Federal laws are currently very vague on the privacy laws they, as well as state and local courts have found in favor of the employee in these situations on many more occasions than businesses have won.

Tread cautiously.

My two cents anyhow.

Edited by TaZsPaZ
Link to comment
https://www.neowin.net/forum/topic/560851-privacy-issues/#findComment-588569265
Share on other sites

Also if you deal with any financial data the old Sarbanes Oxley Act applies.

http://en.wikipedia.org/wiki/Sarbanes-Oxley_Act

A common mislead for most people is the above statement. Please don't take me wrong this is NOT a flame, just a nudge in the right direction.

Sarbanes-Oxley is not about all company's financial data. In fact if your company is not subject to public debts or the SEC (because your company is public) you do not have to be bound by SOX (though I highly recommend following the practices as a "best practices" model). Please bear in mind if your company was public and went private you may still be subject to SOX due to public debts outstanding.

There are various issues (not meant to be all inclusive here) "Privacy in the Work Place", Payment Card Industry (PCI formerly CISP) compliance, Health Insurance Portability Accountability Act (HIPAA), and of course we should all be familiar with Control Objectives for Information and related Technology (COBIT). Like I said you will also want to know any local, state, and federal laws for the industry your shop is doing business in/with. For those of us that consult or work in an industry that services the Department of Defense (DoD) there are others such as knowing the audit procedures for the GAO, IG, DITSCAP, DAA approvals, etc etc....

Wow, didn't really sit back and think of the scope here as I started to write. One of the things that has amazed me when I was consulting up until a year ago was simply that many people don't know the governance policies for their particular industry's that they service or work in. Seems so many people just focus on SOX, PCI, and HIPAA (if in the health industry). It's scary how much more is needed knowledge not just for middle managment and executives but for your basic Net Admin. Even scarier is the fact that most Net Admin's believe that as long as it's in email from the boss' that they are covered if ever an issue arises. *shivers*

Please, I don't want to sound like I know it all as I know I do not even come close to knowing everything. However the industries I choose to consult in I knew the "rules" and the industry I now work in I know the "rules" that apply to my job function and those above me. I urge all that read this to do the same. You never know when you have a disgrundeled employee leave and just how much he/she might do to exact their own personal "vengance" on the company. Thereby putting you at risk as well.

Hmm...this is making me think I need to go find a new job at a small company!

(Am I making any sense today or just rambling on?) :o

Edited by TaZsPaZ
Link to comment
https://www.neowin.net/forum/topic/560851-privacy-issues/#findComment-588579713
Share on other sites

Makes perfect sense to me. The very first company I was with, the IT manager set the passwords for everyone in the company, except for some other managers, and usually within the same department everyone had the same password. I was called out during my holliday and threated to be fired because I had a password in my *.pst file. My boss was accessing my data and telling me it all belongs to the company and there is no reason for me to have any passwords. One admin to rule them all! :) Want to spy on a user? Hell, you're the admin and can get anywhere you want, check out email, personal files, etc... Even better, turn on VNC on the other guy's PC and you can even see what they're doing. How many times did I catch the boss as if watching TV.

I'm now in a big multinational company, IT is split up in so many departments, there is no one that can access everything. Someone needs to access to someone else's email for whatever emergency? Sure, it's possible. Get all the needed approvals and you might get a chance. There was also a lot more that I had to sign than my first job :) It's a whole new ballpark.

But companies without a defined policy on data and such, if you're the admin, sooner or later you'll be between the sword and a wall.

Link to comment
https://www.neowin.net/forum/topic/560851-privacy-issues/#findComment-588586687
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • You've tried DuckDuckGo and Brave Search, now get serious with SearXNG by Paul Hill Over the last decade, it has become quite trendy to dump Google Search in favor of privacy-preserving alternatives such as DuckDuckGo, Startpage, and Brave Search. These search engines have done a very good job at highlighting dodgy practices by Google, such as adjusting search results based on what it thinks you’ll like (filter bubble) and stalking you around the web to advertise to you. While these search engines are good starting points when compared to non-private services like Google, there are still quite a few issues with them. For example, both DuckDuckGo and Brave Search require running non-free JavaScript in your web browser, which is comparable to running proprietary software on your computer, meaning you can be sure about what it’s actually doing in the background. Another issue is that these search engines are hosted on the respective companies’ servers, and you are using a service that you don’t control. Finally, DuckDuckGo, while offering privacy features, relies heavily on Microsoft’s infrastructure for its results and, in the past, has permitted Microsoft tracking scripts. If you are looking for a more private search solution than DuckDuckGo, Brave Search, and Startpage, then I recommend taking a look at SearXNG. It is a privacy-respecting metasearch engine that can be used via different public instances, which is useful for mobile users, or you can install it on your computer or server and run it locally with maximum control. Unlike Google, Bing, or Brave Search, which crawl the web and have their own search indexes, SearXNG is a metasearch engine, meaning it taps other search engines, stripping your identifying data, such as IP address, user agent, and cookies, in the process. Your search query is sent to the other search engines you enable before aggregating the results. SearXNG has deployment flexibility. If you are a casual user or a mobile user and don’t want to run SearXNG locally, you can use a public instance that is hosted by someone else. The main problem with this is that you are putting trust in the maintainer of the instance regarding stuff like logs that they may keep; good hosts should have a privacy policy explaining their policies. If you are trying to use SearXNG, you can also install the software on your device and then head to 127.0.0.1:8080 in your browser and search from there. While you don’t have to worry about a third-party admin like the public instances, search engines could ultimately block your IP address if they frown on you pulling in their search results locally. If you want to run it locally, it’s a good idea to use proxies or VPNs to hide your actual IP. You don’t have to worry about this with a public instance, as search engines never see your IP address. The main privacy benefit of using SearXNG is that it isolates your identity from the underlying engines that it’s capable of searching, such as Google and Bing. These search engines will only see requests coming from a generic server, so they can’t profile you and create a bubble filter that influences what results you see. This also ensures that your search engine doesn’t turn into an echo chamber that prevents you from reading alternative points of view. As a free software project, you are allowed to inspect SearXNG to make sure there are no negative features bundled inside. This sets it apart from the privacy search engines mentioned earlier because you can’t check their source code. As a meta search engine, you are not restricted to getting results from one source. Due to the fact that it scrapes content from other websites, your SearXNG instance will periodically get blocked from different providers, so it’s good to select a range of sources as a backup. While enabling all of the services will give you great results, this can make searching slower. I am personally happy with slower searches for the best results, but you can always check which providers are slowing down your search from the search results page and disable them to speed things up. If you want decent results quickly, enable the main search providers such as Google, Brave, DuckDuckGo, Qwant, Bing, and Yahoo. This way, you get wide coverage without the latency. On the Engines tab in Preferences, do note that there are different tabs, such as General, Images, and Videos, with their own providers that can be toggled and are not covered by "Enable all" while on the General tab, so be sure to dig into each. Just a note, if you want to enable everything, press "Enable all" in one tab, then hit save at the bottom of the page, then do the next tab, and so on. If you press "Enable all", then do that in each tab, and then save, nothing will stick. When I had just some of the search engines enabled, I searched “define nefarious” and results came back with the definition of “define” - obviously that was a sucky result. However, when I had everything enabled, it found dictionary pages for the word “nefarious” and even had an inline definition on the sidebar, which is quite nice too - that was delivered by WolframAlpha for anyone wondering! Probably the worst thing about this meta search engine is that the engines you select are saved with a cookie, so you must enable them on every new device you use SearXNG on, including if you decide to go into incognito mode with your web browser. Honestly, I would say this is the most annoying aspect, and perhaps if your browser lets you choose a separate private browsing search engine, then it would be best to use DuckDuckGo for this portion of your browsing. Another weakness of SearXNG is the random blocking of it by search providers. When you are on the results page, expand the “Response time” box, and it will show things like “Suspended: too many requests” or “access denied”. This is why it is good to enable several providers so that there is always a fallback to get results from. I won’t pretend SearXNG will be for everyone, however, if you enable all of the providers and put up with the slower response time, the results can be really amazing. Even if you don’t want to use it as your daily driver, keeping a bookmark handy that links to it is a good idea if you ever feel like doing a deep dive into a niche topic where other search engines are just failing to bring up any good result, due to the amount of sources it looks on. If you’re interested in radical user control over the software you use, installing SearXNG locally can also be a good idea, but be prepared to be temporarily blocked from sites if you trigger bot sensors without a VPN. Personally, I’ve opted to use a public instance, rather than install it myself. If you want to use it via a public instance, head over to searx.space to find a provider. Let us know in the comments if you have used SearXNG or its predecessor, Searx. What do you think about the quality of the results?
    • Dear Neowin, If it is not too much trouble, can you start using the new-ish designations for Insider Preview? "Experimental" is different than "former Dev" as it can apply to different models, eg 26H1 or 26H2 etc, right? No need to seed confusion IMHO. And, please "finally" update your graphics. OK?
    • Did you see their FAQ, its quite good. Have a look in the Advanced section. https://delta.chat/en/help
    • Just install Linux Mint that is a real blessing and many times cheaper because you can continue using your old Windows computer/laptop with the latest Linux updates.
    • Interesting share -- however it does not make sense: Email messages get stored somewhere, so how is Delta Chat "based on email" and decentralized without actually storing anything? By Web3 standard practices, the various Relays would require dedicated storage to make messages available to the recipients (like a large series of message queue channels, akin to racks of traditional post office boxes)... and Contacts must be two-way confirmed in order for encryption keys to be exchanged (ostensibly every key-pair is uniquely bound between sender and recipient) and the Relays would preserve the public keys in order to facilitate message carriage... or every device stores all sorts of keys and contact info. All of this to say, decentralized messaging is like running Bluesky nodes except instead of discovering/browsing public feeds by various posters (at the given node) these Delta Chats would be relaying encrypted messages (via Relays) that only trusted recipients would have the appropriate decryption key (their own private key) to read it. But this doesn't solve the "it's like email" sales pitch. The only way it's like email is that there's encrypted binary stuff being transported from your app into the federated ether of Delta Chat Relays for others to decrypt (hopefully only the intended recipient)... but outside of this federated relays framework, it is absolutely nothing like email.
  • Recent Achievements

    • Week One Done
      Woland13 earned a badge
      Week One Done
    • One Month Later
      Woland13 earned a badge
      One Month Later
    • One Year In
      bernmeister earned a badge
      One Year In
    • Week One Done
      Scoobystu earned a badge
      Week One Done
    • Week One Done
      tuben earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      502
    2. 2
      +Edouard
      226
    3. 3
      PsYcHoKiLLa
      158
    4. 4
      Steven P.
      75
    5. 5
      FloatingFatMan
      71
  • Tell a friend

    Love Neowin? Tell a friend!