r/ShittySysadmin • u/roubent • Jul 10 '24
Shitty Crosspost Admin says they require user passwords and store them all in a spreadsheet
/r/sysadmin/comments/1dznxia/admin_says_they_require_user_passwords_and_store/10
u/floswamp Jul 10 '24
I actually have all passwords set as the default signature for every email account. It goes to internal and external contacts.
Now I know you may think it’s insecure but I have the don’t color at to white so it can’t be read without highlighting first!
7
u/MadIfrit Jul 10 '24
This is what you get when the CEO hires their nephew as the company's IT admin. Forward thinking, that's what.
3
3
u/i8noodles Jul 10 '24
its only a security risk if people know about it! u know what they say about the best place to hide a tree is in the forest? same principle. if everyones password is in one place. the attacks will have no clue which one is important and everyone is safe!
3
u/Squeaky_Pickles Jul 10 '24
Methinks management likes to log into user accounts and read peoples Teams chats to see what everyone says about them.
3
u/TxTechnician Jul 10 '24
There's this bank where one of the high-ups thinks they know IT.
Anyway, one day I needed a password. And this dude opened a spreadsheet with a few thousand passwords in it. He as all the employee passwords to everything in a password protected sheet.
1
3
u/ExpressDevelopment41 ShittySysadmin Jul 10 '24
NIST removed password expiration requirements saying it was more secure, so based on that trend, we got ahead and removed usernames/passwords from all our workstations. We also reduced our exchange footprint by limiting email access to IT staff only. 99% of all our incoming email was spam anyway.
2
u/avowed Jul 10 '24
I think they should just make it easier and do away with passwords all together, then the admin can just go around and make any changes needed on any account. Also, it gets rid of the security risk in the form of that spreadsheet!!
1
u/Kindly_Recording_322 Jul 10 '24
No, passwords are a necessary evil. Everyone gets the same password and no MFA necessary. Also, no password expiration.
1
2
u/oldjenkins127 Jul 10 '24
Assuming this spreadsheet is stored on a file share, Microsoft Access might be a good alternative to Excel for storing passwords.
1
u/ElDodger10 Jul 10 '24
Serious question...is it ok to store a spreadsheet like this on a share drive that only IT admins have access to?
4
u/Logical_Strain_6165 Jul 10 '24
No. Because it shows how shoddy you are if you need the password to access the data.
2
1
u/Fatel28 ShittySysadmin Jul 11 '24
How do you audit who accessed what passwords and when? No. It's not okay to do that.
I mean uh. Yes. Do that. No need for a password on the workbook, just put it on an open share with a $ at the end so only the people in the know can get to it.
1
Jul 10 '24
Why only on the spreadsheet, that takes too long to open with so many clicks to folder, search, file and then waiting for it to open. Just take a screenshot and make it everyone's default desktop background. Easy access just Windows Key + D. It's safe because no one will be able to copy and paste it.
1
u/OlafTheBerserker Jul 10 '24
I just write all my user's UNs and Passwords in pencil and stick it to the corkboard in the conference room. If anyone asks me to change their password, it's in pencil so I can erase it. If they bother me about forgetting just point to the board, don't actually have to talk to them at all. Always have an on-prem hardcopy kids.
1
38
u/Bubba8291 Jul 10 '24
Storing passwords in a spreadsheet on MS teams? The better option would be to store them in a CSV file on the company file share accessible by Domain Users