Do You Password Reset?

[RichmondTech]

I received a phone call today from someone asking if I reset passwords. I didn't even ask which version of Windows they were running and just said no. I don't feel comfortable doing that for people I don't know. My mind starts thinking about if it's really their computer or not. What do you do?

 

[Xander]

I do. I've not yet (knock on wood) had one of those calls that give me a vibe that it might be stolen.

If I did get a bad vibe, I'd tell them that I would need the machine overnight (so they're not trying to go for some kind of grab&run) and I'd ask them, "for security purposes", for a copy of their ID and ask what I should expect to see on the desktop (to prove familiarity).

 

[Paul Rodgers]

I got an email about resetting a BIOS password. I replied telling them I could take a look, but I would need proof of purchase before I look at it. I didn't get a reply.

If I ever get a store I would check with police to make sure it isn't stolen before doing password removal.

 

[TenYardFight]

My guys are trained to do what the customer asks... Not our jobs to play detective. (with one obvious exception).

What if you drove a cab? Would you try to figure out if your customer was a thief?

What if a (suspected, not proven) thief wanted to hire you to mow his lawn?

Perhaps more relevant: What if you were a mechanic and a guy you thought might be a thief asked you to make his (getaway?) car faster?

Longwinded point being: we just stick to fixing computers.

 

[RegEdit]

I received a phone call today from someone asking if I reset passwords. I didn't even ask which version of Windows they were running and just said no. I don't feel comfortable doing that for people I don't know. My mind starts thinking about if it's really their computer or not. What do you do?

Send them to me. I'll be happy to take the job. Actually I'd just tell them over the phone to go to Control Panel and then Users and follow the instructions. Done. I can't imagine charging someone for something so ridiculously simple unless they insisted.

Ten Yard Fight is 100% right. Legally it's not our job to play detective any more than it's Home Depot's job to ask if someone buying a utility knife is doing so in order to hijack a commercial jet. None of our business. If someone explicitly says "I stole this computer" then obviously you refuse the job, but otherwise it's perfectly plausible that people sometimes want to change the passwords on their computer, recover passwords, bring their family member's computers in for work, etc.

A similar question comes up in this forum about "What do you do if you encounter under aged porn on a computer that someone brings in?" I NEVER sift through and open people's files EVER so how would I know??? And even if a file somehow opened on its own how do I check ID's? LOL. And how do I know that a virus didn't plant the files on their computer? Once you start "playing detective" you are on the fast track to losing customers and gaining a reputation around town.

 

[16k_zx81]

Longwinded point being: we just stick to fixing computers.

^ what he said. Not my job to play detective.

 

[iisjman07]

If you're worried then you could say that photo ID is required for the password removal

 

[nightkingdoms]

I do password resets on an inaccessible computer where the person forgot their password to get in. I require a copy of their ID and signing a form stating that this is their computer and if it does prove stolen, that they knew that it was against XYZ law to have it in their possession.

My day job is for the local Sheriff's Department so it'd look a wee bit bad if I reset a password on a stolen desktop or laptop. The police will not tell you if it's stolen or not, it's against the law for them to tell non-law enforcement personnel that information in the U.S.

However, with my form and taking ID, it can be used in court to convict them on computer tampering charges (e.g. exceeding tgeir access rights) and possession of stolen property. And that's all without me getting in trouble or bringing bad press. ;O)

 

[jaydeee]

Guess they call it "Brute attack"... I've not used any tool that can do that yet, However I've tried resetting Windows accounts. Replacing SAM file would do that but you'll loss all windows accounts not replacing it.

 

[nightkingdoms]

There are easier methods to edit users and passwords on a Windows system (NT 3.1+) than brute forcing the password store. In fact, if you're used to it, you can gain access to any local system in well less than a minute.

Windows has never been a secure platform. I laughed the first time I saw a Windows login screen and it had a Cancel button that dropped you straight into the system. lol

 

[Paul Rodgers]

I used ophcrack once to get into my boss's daughters laptop when I needed to do a virus removal.

I agree with others that we are here to provide a service to others and not here to play detective. The problem is that laptops are easy to steal and we should be providing a service to our communities too.

 

[gunslinger]

^ what he said. Not my job to play detective.

x3 I get paid to work on computers.

 

[RichmondTech]

Thanks for the feedback everyone.

 

[FoolishTech]

I received a phone call today from someone asking if I reset passwords. I didn't even ask which version of Windows they were running and just said no. I don't feel comfortable doing that for people I don't know. My mind starts thinking about if it's really their computer or not. What do you do?

I do the work!

While I *have* turned down a password reset, in hindsight I felt bad about it because I judged the guy. As I recall he came in looking like a hoodlum dressed very ghetto, but with a super nice laptop and no power adapter. Naturally he wanted us to remove the "forgotten" password, AND to buy a power adapter. Now, as fishy as that may look, I could have completely mis-judged the guy and the situation.

Actually I'd just tell them over the phone to go to Control Panel and then Users and follow the instructions. Done. I can't imagine charging someone for something so ridiculously simple unless they insisted.

I think he mostly meant in situations where you can't log in to get to the control panel lol.

EDIT: That idea about taking a DL and signing a form sounds like a good one, though! Not for any real expected use, but I'm sure it's a good thief deterrent.

 

[Xander]

I think folks are ignoring the remote-yet-possible aspect of "aiding and abetting". The point of taking a DL and getting a signature is to cover your own butt.
Yes, it is not very likely that a cop (or even the thief) would try to implicate you in a theft but it's not worth that tiny chance that the cop might be in a bad mood or off his meds or whatever.

If all it takes is a "No problem. Sign here and just let me take a copy of your DL"....

 

[gazza]

Why is it that you are all freaked out by password resets?

How do you know if that person owns the computer there bringing to you for any other repair besides password reset?

Have them sign you work order declaration as per every job, as there is no way in hell I or anyone else will happily hand over there drivers license to someone I don't even know?

Get real guys, or you may as well get Columbo, Steve Mcgarret and the A-team to the password reset.

 

[RichmondTech]

I think folks are ignoring the remote-yet-possible aspect of "aiding and abetting". The point of taking a DL and getting a signature is to cover your own butt.
Yes, it is not very likely that a cop (or even the thief) would try to implicate you in a theft but it's not worth that tiny chance that the cop might be in a bad mood or off his meds or whatever.

If all it takes is a "No problem. Sign here and just let me take a copy of your DL"....

Agreed. I'm all for getting sales, but I'm also all for keeping my business hassle-free as possible which includes the remote-yet-possible aspect of "aiding and abetting".

Granted this isn't as bad as when a pawn shop buys an item then later has to give up the item after they find out it's stolen. I guess when it comes to something like this I tend to be "too cautious".

 

[Xander]

@Gazza: Who's "freaking out"? The only hyperbole I'm seeing is your own.

The only opinions here seem to be "just cover your butt" and "I don't care either way".

 

[nightkingdoms]

Nobody is freaking out. It is a CYOA thing. The ID copy is to prove they were the ones signing, the form is to absolve you of liability.

 

[gazza]

Nobody is freaking out. It is a CYOA thing. The ID copy is to prove they were the ones signing, the form is to absolve you of liability.

Do you get a copy of there ID when a client requests a reformat of there computer? What's the difference?

There would be no court in the country that would hold a computer repairer liable or responsible for a password reset on a computer that may or may not be stolen.

I would be more concerned about you having the legal right to obtain copy of someones ID, yes you may request to have a look at there ID and compare photo's but you should not be making copies it at all.