Employer keeps lists of (and uses) client's passwords without client's knowledge

[tankman1989]

Sorry this is long, but it is a difficult situation to understand unless you have all the facts,so please bear with me.

Ok, here is the situation I came across while working for a small local IT firm. The IT firm supported a fairly large regional company (about 150 employees) which is vital to the security and productivity of the immediate area. If this business stopped running, Millions of people would be negatively effected and a GREAT many people and business would not be able to function at all. This company also deals with large sums of money on a daily basis (about $15 million in transactions/good delivered)

So, this is a fairly important company and I would have expected their security to be pretty tight/high. What I found was next to no security and what security there was is VERY lax and often bypassed with common passwords, simple passwords or passwords taped to the LCD screen (on the CFO's monitor none the less!).

Now to the main issue.

We were running Linux servers with XP work stations. My bosses were able to grab the hashed passwords from the network (or on the Linux server) and use Rainbow tables to crack the passwords. Their policy was to keep this list a secret and use the password(s) when it was convenient, in cases such as when they needed to log into the customers profile and make changes or check thing (like Outlook setup and other software). There were many more reasons given by my boss (the IT firm) for having the passwords but many of them seemed strange and bordering unnecessary or unprofessional.

My boss and other two employees (his employees were his father-in-law and brother-in-law) made it a very clear point that I/we were never to let on that we had the password list or that we used their passwords. The boss said "It would be VERY VERY bad, we would get in a lot of trouble". This was another flag that they knew what they were doing was wrong. (at this point I considered quitting but I REALLY needed the job)

I was also told to download the password list and keep it in my encrypted folder on my office desktop AND in an encrypted folder on my personal laptop which I use at work & @ home to do some remote admin work if needed. Well, this is where I felt VERY uncomfortable almost as if I were breaking some serious laws. I made it clear that I didn't want it on my desktop and especially on my laptop but I was "convinced" that it wasn't a big deal because the other 3 guys I worked with did the same. It was stressed that I had to be prepared to assist clients at all times and in any manner, and this meant having the secret password list. So I begrudgingly put the list on my machine but only after sending emails to my boss protesting the existence of the list and especially my possession of it. I used Camtasia (records what is seen on the monitor as video file)while I composed the email and sent it, requested a read receipt and recorded that as well. I also backed up my PST file and uploaded it to my web server and my home machines along with the video file of me composing/sending the email.

A few times I almost felt as if I was being set up to be blamed for something. My boss and his in-law employees went on 9 day vacation 12 weeks after hiring me so I was left alone with the shop and about 600 off-site people to support (we had more clients than the one mentioned). No one in the IT firm had taken a vacation in the 4 years since the company was created - but now they take one leaving a new employee at the helm!? During this vacation I had to use the list at least 10 times which was very unsettling. When they returned I told them I was taking a week off myself (because I had to think about my situation there - there were other issues where my boss acted with little integrity and or honesty).

So, I want to know what you people think of this situation.
Would you have been suspect of the possession of the list? I figured that if anything went wrong within the company (stealing emails, financial records, bank info, making wire transfers, etc) I might have had a tough time proving that I had nothing to do with it. As the new guy and not being "in the family" I didn't want to be in the position of "guilty until proven innocent".

So, what are your thoughts about the following:
-my boss creating the list
-boss & co-workers logging in as employee to fix issues rather than changing
password then logging in under new password and then changing back?
(we had LOADS of time on our hands so this wasn't for lack of time).
-Being told to keep list on personal office desktop and personal laptop (which
I owned).
-The fact that the made a big point of saying that they would be in "VERY big
trouble" if the company exec's found out.

Just as a note, I took my week off, went camping to think and clear my head, and was a day late coming back (I told them I was going to be back late). I was fired that day due to being late, lol. So I didn't have to worry about the list anymore. I told my Boss that he didn't have to worry about me and that I wasn't angry or upset and he didn't have to worry about me taking any type of "revenge". He laughed and said "what could you possibly be angry about or upset with?" I told him some of the issues such as the password list, lying to customers about their broadband speed and other things. He said that they weren't an issue to begin with and that I couldn't "hurt" him.

Some people just don't care what they do or how they conduct their business as long as #1 gets theirs!

 

[14049752]

Your boss sounds like an idiot.

From the thread the other day, where he's telling you about Macbooks being unable to use WPA and now this...you should find someone with more knowledge AND more integrity.

I know the job market is supposed to be rough, but seriously, working for this kind of person can affect you in the long term.

 

[vontreigo]

I would notify the FBI or Home Land Security.

 

[callthatgirl]

Many IT employees end up having way too many rights and way too much information. I left a corporate job once with a PST full of employee social security numbers (that I didn't know I had kept until I had been gone about 6 months and was going through it looking for a personal email) and other important info, like home addresses and such.

I was a helpdesk employee, who should never have had that access.

Not sure what to say about your post, but glad you're gone and on your own to learn what not to do in the future as your biz grows.

 

[cmonova]

Well my answer will surely not be the most liked...

You say ""It would be VERY VERY bad, we would get in a lot of trouble". This was another flag that they knew what they were doing was wrong. (at this point I considered quitting but I REALLY needed the job"

" I made it clear that I didn't want it on my desktop and especially on my laptop but I was "convinced" that it wasn't a big deal because the other 3 guys I worked with did the same"

So he tells you that it would be VERY VERY bad....but then convinces you that it's ok? Then you use Camtasia to do an email and send files to your own web server?

My thoughts on this....You need to start using your head and standing up for yourself and doing the right thing. If you thought what they were doing was wrong and then you did it anyway....why? If you were so concerned with their cloak and dagger methods then you went an recorded sending things to them....why? You used the list 10 times...but it was unsettling...Why?

Then you say "I considered quitting but I REALLY needed the job"...to me that is crap....I have worked places since being a contractor and saw things that I totally 100% disagreed with the way they were doing it to the point of things being unethical...I didn't hesitate to think "I need a job" or a I can't quit because....I just went to the Program Manager and I told him I quit and I also told them why.

Maybe it's the 20 years in the corps or just life's lessons but to me very simple...Just like "Ethics" ...."doing the right thing when no one is watching"...You put too many things that to me would of raised a flag instantly and I would of walked.

 

[tankman1989]

Isn't it amazing how much info IT people have access to? Even the low level techs?

I was doing a product roll-out/migration of desktops and laptops of a fortune 100 company for Dell. This was way below my ability but I needed work so why not. It was clear that I knew much more than the girl who was in charge of the roll-out for the pharmaceutical company. She couldn't even transfer a profile, clone a hard drive, make a ghost image, copy a ghost image and more even AFTER being shown how to do it multiple times!

I was given the task of exchanging the upper management's computers like the CEO, CFO, COO, VP's and accounting. I had their office all to myself for at least an hour at a time. I could have copied their user profile to a thumb drive or a 2.5" portable HD without a problem OR I could have just pulled the HD from the system and no one would have ever known until months later IF they even checked then. I believe the employees even had to leave their computer logged into their user account for the transfer!

Knowing that these machines were going to be resold and often the drives aren't removed/replaced or wiped, I asked the girl in charge of the roll-out if they had any plans for destroying the drives or data prior to the computers leaving the building. She asked why in the world would they need to do that. Alarms went off in my head. I gave a brief explanation and she looked like a deer in headlights. She immediatly began making frantic phone calls and was extremely flustered and became abusive towards all the Dell contractors working the job.

I went to another office to replace the machine, it was the head of accounting. I asked if there was any important information on the machine, information which if stolen could pose a security risk. She looked at me with a wild wide eye stare/gaze and said "you better believe there is". And there was. All employees store everything on a local machine under their domain profile but they backup files and profiles to a domain server. There were 10's of thousands of bank accounts, credit cards, SSN's and much more on the machine. I asked if she would be upset if the computer left the building with all the current contents on the hard drive. She got very upset and asked what was going on. I explained the situation and told her that I had no "power" to make things right but I wanted to bring it to the attention of someone who had a vested interest in the data and company. She was VERY thankful and went on to talk to the CIO and CEO.

As it turns out, the hard drives were never scheduled to be destroyed or cleaned. The girl running the roll-out was a basket case and was clearly there for some other reason than computer skills (I'm thinking affirmative action female/race...)

I was then asked by the company contracting to me to not return to the job and have not been offered a job with them since.

How is that for an eye opener?

 

[tankman1989]

Well my answer will surely not be the most liked...

You say ""It would be VERY VERY bad, we would get in a lot of trouble". This was another flag that they knew what they were doing was wrong. (at this point I considered quitting but I REALLY needed the job"

" I made it clear that I didn't want it on my desktop and especially on my laptop but I was "convinced" that it wasn't a big deal because the other 3 guys I worked with did the same"

So he tells you that it would be VERY VERY bad....but then convinces you that it's ok? Then you use Camtasia to do an email and send files to your own web server?

My thoughts on this....You need to start using your head and standing up for yourself and doing the right thing. If you thought what they were doing was wrong and then you did it anyway....why? If you were so concerned with their cloak and dagger methods then you went an recorded sending things to them....why? You used the list 10 times...but it was unsettling...Why?

Then you say "I considered quitting but I REALLY needed the job"...to me that is crap....I have worked places since being a contractor and saw things that I totally 100% disagreed with the way they were doing it to the point of things being unethical...I didn't hesitate to think "I need a job" or a I can't quit because....I just went to the Program Manager and I told him I quit and I also told them why.

Maybe it's the 20 years in the corps or just life's lessons but to me very simple...Just like "Ethics" ...."doing the right thing when no one is watching"...You put too many things that to me would of raised a flag instantly and I would of walked.

The only thing sent to my web server was the video of my email protesting my boss's request. The password list stayed on my office PC and I created a sealed, encrypted folder with the list inside it on my laptop. The software logs every action taken with regards to the folder whether it is simply viewing the directory list, opening a file within or anything else. The only action ever recorded by the program is the original encryption, so I don't see the problem. This isn't the military, department of defense or state/federal work, it is a private business so I broke no laws or procedures.

As for me standing up for myself I did what I could to keep my job. I could have told the company about the password list but that would have been a huge head ache. The IT firm said they have been doing it this way for 3-4 years and have had no problems. I felt uneasy because I came from companies where this wasn't standard procedure and would not have been done. All companies operate differently and as long as I wasn't crossing any legal lines, I had little ground on which to stand and complain.

The "VERY, VERY bad" statement was in regards to them potentially losing their biggest client and over 50%+ of their income. This wasn't in reagrds to some legal issue.

As to your last statement, let me stand and applaud you. You sir are a truly amazing man and if we all could be as fortunate and brave as you this world would be without problems. I did need the job, I had spent A LONG time looking for one up until the point I landed this one. Stand on your soap box and criticize all you want but I'm sure many, if not most, would have done what I had if not less. I know many people who would have never questioned the things that I did let alone tell the boss that they did not agree.

Finally, I'd like to say that a large percentage of your posts are extremely arrogant and you give off the impression that you are always without fault. When I see people like this it is always amazing to see what they are truly like when all the bravado and pretense is done away with.

 

[Winchester Computer Care]

Grabbing the hashed passwords from the network and using Rainbow tables to crack them is a Federal Crime...and having actually been involved in Law Enforcement on the Federal Level, I can say that leaving that bunch behind was the best decision you could make.

I would also suggest you take vontreigo's advise and report it to your local FBI Field Office because it definitely looks like they may have been setting you up as a fall guy.

 

[Knightsman]

Blow their roof off man.

Do it silently if you have to, report it to the news, or send them a letter. Let them be the ones to "break" the story.

I consider this to be illegal, and if you have that conscience, like it seems that you do, do something.

 

[Knightsman]

Then you say "I considered quitting but I REALLY needed the job"...to me that is crap....

Maybe it's the 20 years in the corps

Your posts are extremely arrogant.

I think its completely arrogant. If you consider this "crap" then I guess being in the Corp kept your head above water, and you havent had a hardship for a job that your family depended on to keep food on the table. What exactly did you do in the corp?

Dont be an asshat, consider the hardships of someone elses life before acting like that. many people work in places they hate because they have no other option. We can say they have options all we want, but at the end of the day, they would end up with a hungry family.

 

[cmonova]

I think its completely arrogant. If you consider this "crap" then I guess being in the Corp kept your head above water, and you havent had a hardship for a job that your family depended on to keep food on the table. What exactly did you do in the corp?

Dont be an asshat, consider the hardships of someone elses life before acting like that. many people work in places they hate because they have no other option. We can say they have options all we want, but at the end of the day, they would end up with a hungry family.

The OP ask a question of "what are your thoughts" and those were my exact thoughts. Been in the same boat many times. have absolutely NO problem working at a job that I hate if it means providing for my family. But, to work somewhere that they want me to do things that I feel are not ethical then yes to me that is different and I have NO problem quitting that type of job.

Whhen I retired took a job paying about 70K almost 10 years ago which was great money. That was the first job I walked away from due to how they were conducting business. To me was not right. I walked in and quit. Left called the wife and told her what had happen and her response was "I hope you quit"....Never questioned where we would get money, how we would feed the family, pay the mortgage etc. And personally I did not care nor think about it. I have never and never will let providing for my family stop me from doing what I think is right.

The "hardship" as you say would of been for the owner to say they want all these things done and then the OP saying "screw you" and quitting. Then putting a post and asking "what are your thoughts"...That to me would of been a "hardship".

As far as a large percentage of my post being arrogant well i'll assume those are the post that are "different" then your way of thinking which is fine.

 

[Knightsman]

The OP ask a question of "what are your thoughts" QUOTE]

Yes, thoughts on the situation, not on a life decision he made.

I dont think all of your post are arrogant, just that comment.

Your job, you quit after retirement. And if thats the case were you also receiving retirement money?

This was unethical, At the same time he really needed the job. He could have been at risk for losing his house, or car or something that meant a huge life changing event. You need your home, and you need a car to get to work. unless of course you work within 5 miles of your home and dont mind walking.

At this case, the best thing to do is start looking for a job and hope you get one quickly. It's irresponsible to quit your job if something that is important depends on it. I'm not saying he does, but I just hope your not genalizing everyone. I think you will always find someone doing something unethical at a big workplace.

From what I can tell you have a strong personality, I do also, and when i see this stuff, I would do the same thing you would do. But I cant say someone elses decision to stay because they had no other choice as "crap". We just dont know their life circumstances.

Of course this all changes based on any "illegal" activities.

 

[cmonova]

To me asking thoughts on the situation were exactly that. And I put my thoughts.

Yes exactly I was receiving retirement money which I do to this day...Total each and every month maybe $1,200 or less. At the time my house payment was $1,400, plus 2 new cars, son's car, wife, and 2 children. I was the only one employed at the time.

I started looking the very next day and would do it all over again. You are absolutely correct there are always people doing unethical things but there is a difference between just "someone" doing that and your employeer asking you to also participate.

You are right everyones circumstances are different and maybe in the future the OP will just say screw it and go a different path should the situation ever arise again realizing that there are other options.

Yes strong personality and no problem saying what i'm thinking and it either works for you or it does not. But, at the same time I have no problem helping anyone and everyone that has ever asked in this industry.

 

[ZenMike]

Though to some of you he might be a bit blunt for your taste, I mostly agree with cmonova, though I may be influenced by my 5 years in the Corps

If you took your boss at his word that what they, and then you, were doing was "VERY VERY bad", then I guess it's partly relevant what you took that to mean. Did you think what they were doing was almost certainly illegal, or just highly unethical. Either way you decided to go along with it. You can justify all sorts of actions with "but I really needed the job." I get it, but don't blame others for calling you out on it and I personally wouldn't hire someone with those decisions in their past.

To your specific points, the method for gathering the passwords sounds unacceptable and shady, but using the customers password to log in could be ok with consent. I almost always ask for the users password on systems I work on, corporate and residential, and I'll keep that for future reference.

 

[Knightsman]

Though to some of you he might be a bit blunt for your taste, I mostly agree with cmonova, though I may be influenced by my 5 years in the Corps

If you took your boss at his word that what they, and then you, were doing was "VERY VERY bad", then I guess it's partly relevant what you took that to mean. Did you think what they were doing was almost certainly illegal, or just highly unethical. Either way you decided to go along with it. You can justify all sorts of actions with "but I really needed the job." I get it, but don't blame others for calling you out on it and I personally wouldn't hire someone with those decisions in their past.

To your specific points, the method for gathering the passwords sounds unacceptable and shady, but using the customers password to log in could be ok with consent. I almost always ask for the users password on systems I work on, corporate and residential, and I'll keep that for future reference.

ugh, so you wouldn't hire someone for making a mistake in the past? Even though they possibly learned from it, and is possibly a better person?

I'm gonna stop this thead is gettin pointless and to damn personal.

/thead

 

[NeutronTech]

ugh, so you wouldn't hire someone for making a mistake in the past? Even though they possibly learned from it, and is possibly a better person?

I'm gonna stop this thead is gettin pointless and to damn personal.

/thead

Although it might seem personal, I think this is a valid discussion, even though it has drifted from it's basic topic. I'm sure there are others faced with similar situations and have to make tough choices. Whatever the reasons behind those choices are, you always have to remember that there are consequences. What you have to consider is, are those consequences worth the decision? That's not something that can be answered by anyone other than yourself.

 

[ATTech]

Simple question: why not just not use the password? It's entirely possible to get by in IT without having everyone's password. Especially since nobody knows you have it, they expect that you have to have them log in so that you can fix the issue.

 

[Knightsman]

Simple question: why not just not use the password? It's entirely possible to get by in IT without having everyone's password. Especially since nobody knows you have it, they expect that you have to have them log in so that you can fix the issue.

I think the problem comes from a user, just because I am taking care of the network, doesnt really mean I should have a users password. If they have sensitive info. I would have a admin password, but wouldnt have direct access to their files. I should be able to get the job done without it, unless its user specific.

 

[ATTech]

I think the problem comes from a user, just because I am taking care of the network, doesnt really mean I should have a users password. If they have sensitive info. I would have a admin password, but wouldnt have direct access to their files. I should be able to get the job done without it, unless its user specific.

I think you might have missed a not in my post. I'm arguing that he just NOT use the passwords.

 

[Knightsman]

I think you might have missed a not in my post. I'm arguing that he just NOT use the passwords.

I think your right.