Users storing passwords on personal gmail accounts

[-]

AutoModerator@reddit

Your [submission](https://www.reddit.com/r/sysadmin/comments/1nfgl3k/users_storing_passwords_on_personal_gmail_accounts/) in /r/sysadmin was automatically removed because it appears to be empty. Please add some content. A headline or title is not sufficient content. If you feel this action is incorrect, please [message the moderators](https://www.reddit.com/message/compose?to=%2Fr%2Fsysadmin). *I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/sysadmin) if you have any questions or concerns.*

Reply

[-]

Fitz_2112b@reddit

Implement SSO for all apps that support it and use a keycard and PIN to sign into the computer? I don't work in healthcare but I know when I go to my doctor, the computers in their exam rooms are accessed by them holding their badge up to a card reader and then entering a PIN number. That signs them into all of their apps

Reply

[-]

Positive_Meaning1665@reddit (OP)

I really like that idea! Thanks for responding.

Reply

[-]

Low-Armadillo7958@reddit

Use GPOs to block signing to chrome and all other browsers. Implement policy that requires users to use complex passwords and your preferred password manager. Make it clear users get 2 warnings and then are fired on the spot for breaking policy. Boom, done.

Reply

[-]

Positive_Meaning1665@reddit (OP)

Honestly, a good idea to just block it from happening through GPO. I will propose an idea to my boss about using a password manager, I use KeePass all the time so I will do some research on that. Thanks for responding.

Reply

[-]

Deceptivejunk@reddit

You better have the backup of the higher-ups. If doctors and providers use that and don’t want to be bothered resetting passwords, they’ll raise hell.

Reply

[-]

Positive_Meaning1665@reddit (OP)

Good point! Last week with the approval from the CIO I made a GPO to make the computers go to lock screen after 15 minutes. Some of the doctors and employees lost it when they had to sign into computers (most understood) but the ones that didn’t were not very nice about it.

Reply

[-]

Royal-Wear-6437@reddit

Did you advise them before implementation (with a reason)? Communication is key

Reply

[-]

Positive_Meaning1665@reddit (OP)

To be honest, after thinking about it, I maybe could have done a better job communicating. I sent a few emails out but I only gave them a few days notice, so if they were off that day then they probably didn’t see my email.

Reply

[-]

Deceptivejunk@reddit

I would write a report about the risk of it. If Management/Csuite are okay with it, just save their approval and move on to the next problem.

Reply

[-]

DayTooth48@reddit

Ah, well if you dont already provide a password manager then of course people will use whatever is easiest and accessible.

Reply

[-]

Call_Me_Papa_Bill@reddit

Unless you go passwordless. Easier said than done, but worth the effort. When we first started to implement our passwords switched to yearly expiration. I always had to do SSPR every year because I never had any idea what my password was, never used it. Now our passwords never expire and there isn’t a single work resource I can’t access without a password. Biometrics, FIDO2 and phishing resistant MFA for the win!

Reply

[-]

chesser45@reddit

You doing Fido2 badges? Any idea what your cost is like?

Reply

[-]

Call_Me_Papa_Bill@reddit

Might be multiple options, big org and I’m in services (consulting) not internal IT. I know you can request a free USB key, (micro or touch) be issued if you want, but not every one needs one.

Reply

[-]

Positive_Meaning1665@reddit (OP)

That might help me propose the idea, haha. Thats true though, people always like to take the path of least resistance.

Reply

[-]

applecorc@reddit

We have the extension for our PW manager auto installed on the big three browsers using group policy. In addition to preventing all extensions we don't explicitly approve.

Reply

[-]

fedexmess@reddit

Like taking pictures of their passwords with their phone or storing them in their personal phone's notes app.

Reply

[-]

gwig9@reddit

Start looking for a secure and easy to use PW manager. Reporting the possible security risk is good but you also want to remove the reason why your users were doing things that way. Deploying a good password manager will be key to preventing this from happening again.

Reply

[-]

Positive_Meaning1665@reddit (OP)

Honestly, I use KeePass on my work computer!Whenever I make an account I just have the password be as long as possible because I can copy and paste it from the password manager whenever needed. Thank you for responding!

Reply

[-]

hasthisusernamegone@reddit

Keypass is not the solution. I use it extensively and I'd never recommend it to a non-technical user. You need something easy to use like Lastpass or Bitwarden. Obviously do your own research on these as I'm sure someone will leap in to say they've both been compromised.

Reply

[-]

ItJustBorks@reddit

Anything but LastPass. Fuck them.

Reply

[-]

hasthisusernamegone@reddit

Anything? Including personal Gmail accounts?

Reply

[-]

ItJustBorks@reddit

I'd trust post-it note on a fridge more than LastPass. At least then you know for sure that your credentials aren't securely stored. False sense of security is a worse situation.

Reply

[-]

MDParagon@reddit

Keeper works too

Reply

[-]

NETSPLlT@reddit

KeePass is unlikely the solution. You need something managed, auditable, logged, with sharing etc. We've used 1Password and then Keeper and both worked fine for us. Applications/SSO with SCIM for enablement.

Reply

[-]

jar92380@reddit

Do you have a password solution in place like keeper or 1pass? Might be worth looking into and having the CIO explain to all not to store company passwords in personal email accounts

Reply

[-]

finbib1@reddit

We have had 1password for about a year, and it works well as long as the emails you send to the users explain the reasons for using a department vault vs. an employee vault. I didn't do that initially, and now I need to do it almost one on one with the users to make sure they understand what is supposed to happen (our best practices). The folks at 1password should be able to help you determine best practices since you are in healthcare IT and have HIPAA at every turn.

Reply

[-]

jerwong@reddit

Implement MFA everywhere. That will effectively render their shared password useless.

Reply

[-]

p47guitars@reddit

You know I've seen sysadmins do such things. Usually what happens is a provider freaks the fuck out and starts to personally attack the IT pro on question. Anything that adds a millisecond to any of their workflows is considered heresy. It's usually met by long ass meetings and very poignant anger-driven shouting. I've seen a lot of this stuff myself as an MSP. The very idea of having your own user account, passwords and MFA is a carnal sin to them.

Reply

[-]

i8noodles@reddit

I would ignore them. give some boiler plate email about security, if it is unacceptable, bring it up with there managers.

Reply

[-]

p47guitars@reddit

Even if you remind them of the cyber security insurance implications they believe whatever practice management solution they're using is secure and "has the important data". Meanwhile they're leaving their credentials in plain text on the desktop because it's "easier" to login that way... Why are highly educated professionals like this?!

Reply

[-]

i8noodles@reddit

bias. they are, objectively, useally pretty smart people. they know alot about 1 thing and useally ok with following advice for things they know nothing about but IT is different. they interact with it everyday so they assume they are, if not experts, somewhat advanced users. they are basically at the very start of the dunning Kruger effect and at peak of mount stupid. either way, not your battle. u have provided them the solution. u have given them fair warning. if they want to shoot there own legs off then its on them

Reply

[-]

gauc39@reddit

Users will be users. After a couple of months they'll shut up, there's always an adjustment period. Sent a few reminders, have a clear policy, stick to it. The first month or two is always rough.

Reply

[-]

Deadpool2715@reddit

I like a lot of the responses here, another take would be blocking signing in to and blocking saving passwords the major 3 browsers. If they can't sign in to enable sync, and can't save passwords, they can't do this specific violation. It's playing wack a mole, whereas other solutions are more targeted at the root cause

Reply

[-]

ChiefBroady@reddit

We block Gmail and similar stuff. Personally, I’d give everyone a write up who does that shit.

Reply

[-]

LastRed1@reddit

You are right to put stop to it, but someone in iIT or security should be proposing a solution to their issue (saving passwords). Like introducing and helping them set up a password manager. I hate when iIT comes in and tells me I am doing something wrong and does not offer a solution and training for me to correct. I am not it trained and have other roles and reponsiblities that they know nothing about. We had IT come in lecture my group about thus very issue and point to the password manager that they contracted for the company. When we asked about training and assistance, they pointed out that there are hundred of youtube traing videos to help with the product. Fast forward 2 year, and IT discontinued to contract for the password site. WTF, no commitment by IT.

Reply

[-]

midcap17@reddit

How are your users educated on the use of the password manager that you supply them with?

Reply

[-]

dc0denull@reddit

Block all external email. It's the only way.

Reply

[-]

Nova_Nightmare@reddit

You don't allow them access to Gmail at all and you report them for violating security regulations around health information. If your medical facility doesn't have these policies in place, they're in big trouble. If they do and aren't enforcing them, that's also trouble, but perhaps it's a wake up call. You reported this to your manager, pay attention that something is done, if nothing is done, you might consider going higher up the chain or any rewards offered for reporting directly.

Reply

[-]

Salt-n-Pepper-War@reddit

This is alarming, reporting is the right thing to do

Reply

[-]

ExceptionEX@reddit

We don't have a problem like that because this is a firable offense, and we provide them and monitor usage of a password vault. I don't care how stupid they are, or how they act in their personal life. But we are pretty strict about dumb shit behavior like this when it comes to the work place. We also feel we area obligated to make this system as simple, and redundant as possible, so they would have to actively work against us to break policy. If we catch something like that, we write it up, suspend the account, and let HR handle it. Aside from the c-suite, they honestly get away with whatever, so we sort of have to do whatever we can to get them to play ball.

Reply

[-]

maceion@reddit

No. You are not overreacting. A lawsuit could risk millions if their 'password' storing habits offended anyone.

Reply

[-]

SecurityRabbit@reddit

Unless Google is a sanctioned application at the hospital, block it at the application filtering level. You can do that for google acccounts, google mail, etc. Application layer 7 filtering on network packets can be a technical control enforcer. Beyond that, the manager in charge of that department that sanctioned that activity needs to be reported to the CISO or CSO and let them handle it. IT cannot be the disciplinarians for when there is a severe policy violation. That is C-suite's job.

Reply

[-]

samspopguy@reddit

Can’t you just use edge and sign in with their m365 accounts and have edge save the passwords.

Reply

[-]

Certain_Hotel_8465@reddit

Use one password across organisation.

Reply

[-]

420GB@reddit

We don't handle that situation at all because it cannot ever happen because obviously we block log ins with personal Google accounts to Chrome

Reply

[-]

Myte342@reddit

I give a speech to new users. "You do not own the company WIFI, assume that whomever does own it can see anything you do on their internet. You do not own that email account, assume the person who does can see every email you send. You do not own that PC, assume that the person who does own it can see everything you do on it. If you log into personal accounts on that PC, assume whoever owns that PC can now see your personal stuff. And if you are still logged in to personal stuff when you leave the company, assume that someone can log into this PC and now has access to your personal accounts. I am not trying to scare you, just making sure you understand that actions have consequences. If you don't want the company to see what you are doing with your personal stuff then keep your personal stuff off their stuff and only do personal stuff on your own stuff that you own." With that said, there is no excuse to use a truly personal gmail for bookmarks/password management. If nothing else IT can make a generic 'personal' (meaning not corporate licensed) account they control just for syncing their work stuff. Logging into an actual personal account is a data security risk even if they promise not to sync passwords or whatever, they could accidentally do it in the future. Sounds like your company needs to have an official system for password/bookmark management even if it's just what I suggest above, creating a google account for the users specifically for this purpose but owned/operated by the IT department. Side note with this, you know you can make a Google account using your work email right? Like, a full Google account that uses your regular work email address instead of creating a Gmail address, still syncs bookmarks/passwords in Chrome and whatnot. But linked to their work email for password resets and whatnot.

Reply

[-]

Geminii27@reddit

Tis isn't an IT issue. It's a security/HR issue. It doesn't matter that they're using Gmail. Legally, they're recording passwords to corporate systems in places which the employer does not control (and a third party that the employer has not agreed to both controls and has access to). What would be the legal department's response to users writing down their passwords on sticky notes and putting them up on shopping center corkboards? Or storing them in a shoebox down at the local bar?

Reply

[-]

Chimsokoma@reddit

Do you provide a Password Manager ? If Yes = Their Problem If No = Your Problem Provide the Tools first then apply the enforcement.

Reply

[-]

Hyperbolic_Mess@reddit

Can't blame the employees on this if there isn't a clear IT policy on password storage. This incident just demonstrates a need for an approved password manager and/or training on how to use it to generate secure passwords and tighter controls on chrome. I hate it when users get blamed for trying to do the right thing when faced with lacking IT guidance and/or support, is our job to make it as easy as possible for them to do the right thing

Reply

[-]

Warrlock608@reddit

Take how many patients you have, multiply it by the cost of a HIPAA violation, and tell them that is how much money they are risking because they want to be lazy. Seriously PPI PHI needs to be protected and it is \*THEIR\* responsibility to do that as healthcare professionals. Seriously this needs to be fixed yesterday.

Reply

[-]

Positive_Meaning1665@reddit (OP)

I completely agree, and thank you for responding! I am honestly surprised by how little some people care about HIPAA violations. We have a policy that states you can only say the patient’s ID and they will instead send emails stating the patients full name, ect.

Reply

[-]

rm-rfroot@reddit

Account /medical record number in this context is still a HIPAA Violation See 45 CFR 164.514(b)(2)(i), Better policy would be all emails with PHI/PII need to be sent encrypted.

Reply

[-]

--RedDawg--@reddit

Knock knock

Reply

[-]

Ekyou@reddit

At my hospital that is a fireable offense. Somehow then they figure it out real quick.

Reply

[-]

bogusputz@reddit

In addition to explaining why that is a bad idea. Have a proper product to implement that covers the obvious need.

Reply

[-]

corree@reddit

Do you have any more info on this multiplication thing? That’s wild lol

Reply

[-]

HerfDog58@reddit

Does your employer have a compliance officer? Report it to them.

Reply

[-]

SurpriseIllustrious5@reddit

Budget for password managers

Reply

[-]

NaturalHabit1711@reddit

You can block gmail on the firewall. Make exceptions where needed

Reply

[-]

llDemonll@reddit

Block the ability to do this at a browser-level.

Reply

[-]

i8noodles@reddit

money, manager, malpractice. if u have all 3, u can enforce tight controls. I would ban gmail for starters, no one should be using personal emails on work devices anyway. this is an easy one to implement. tell the legal department that gmail is not under your control, any leaked information will not be on IT as we have clear rules on how to manage passwords, if none, create some. password manager or sso would be good. sso in particular if u can implement it and have the budget for it.

Reply

[-]

BoilerroomITdweller@reddit

In our company we have to do privacy and security training mandatory every year. It clearly states if you store your password in the cloud non-business it is grounds to be fired. Sounds like the company needs to make a security course and have their employees sign it.

Reply

[-]

armonica17@reddit

You're not overreacting. Imagine if a bad guy manages to get access to that list on gmail. Now it's just a matter of installing ransomware. Tomorrow the place could be silent as nothing can get done. They're all locked out. How much would it cost to fix it? 100K, 5 million, 20 million? More? Depends on the bad guy. Not being able to do the things you do could add up fast. I've seen companies out of business for 2 weeks. Nobody can sign in, none of the phones work, no voice mail, it's as if they closed up shop. All because one person was careless. They had backups fortunately. Move to single sign on. Then all they need to do is remember one password or better yet something like a yubi key. The great thing about a yubi is it is always changing. It's also fast. They support usb connections though it would be better for a near field communication option so you don't wear out the usb. Not having to go through an incident is worth it. HIPPA violations, public trust, data, and so on.

Reply

[-]

Papashvilli@reddit

One step would be to restrict personal email access on company devices. It would go a long way.

Reply

[-]

swiftarrow9@reddit

Start issuing smart card authentication instead of passwords.

Reply

[-]

Bimpster@reddit

block webmail at the firewall.

Reply

[-]

12inch3installments@reddit

I work in healthcare, too, and we have this same issue, albeit the scale is different. We are making changes as we switch to Entra and enforcing new policies by Intune. - Edge is the default browser - Not deploying Chrome as a standard deployment - Edge automatically logs in their M365 account - Edge requires an account to be logged in & is restricted to accounts from our tenant This forces all bookmarks and saved credentials to be stored in their M365 accounts, which we control, force MFA on, and have CAs for access on, too.

Reply

[-]

Known_Experience_794@reddit

In my experience CEOs, whining and withholding budget are at fault. Not IT (in general). It doesn’t help that users are dumb and lazy.

Reply

[-]

PristineLab1675@reddit

Single. Sign. On. SSO Then passwordless. What different applications are they signing into? Our company policy is SSO is mandatory. We’ve moved vendors and forced others to build SSO then we can use them. I understand not everyone can push that, and some scumbag vendors charge extra for SSO. It’s a cost of business - not doing SSO lands you in exactly the situation you are in. Users violate policy, willingly, because they don’t know what options they have. SSO takes that RISK and centralizes it, as well as greatly reducing it. How many different identities are your users managing? A small fraction of mine have 2 identities, the second one being an admin account that can’t login to laptops and is monitored by PAM tools. If your users have many unmanaged logins, do those logins have multifactor forced? How do you know? (You don’t). So now you have folks writing down passwords, sharing it sounds like, and no mfa. Not doing these things is a risk. If you bring it to their attention the right way, show them a good way forward (even if that involves spend) then the business can make an informed decision. You might not like or agree with it, but if the decision makers don’t know what they can do and how much it could impact them, they can’t make a good decision.

Reply

[-]

Ok-Double-7982@reddit

MFA on work applications helps curb this when you have morons who use the same damn password across applications.

Reply

[-]

Ol_JanxSpirit@reddit

Do you have an acceptable use policy? If so, does this violate it?

Reply

[-]

SecurityHamster@reddit

This creates an enormous liability for your workplace. And it can’t be solved by IT. You need to escalate this to your manager and have them continue escalating to the top so they can set a policy for the company that there will be no storage of company data on personal accounts, period.

Reply

[-]

InspectorGadget76@reddit

Disable the password manager in Chrome/Edge

Reply

[-]

Dark_Bros@reddit

Our company pays for enterprise edition of 1Password. We implement it and train our users on it.

Reply

[-]

Alzzary@reddit

You did the right thing. It's management problem. People in healthcare need something like imprivata to manage their sessions. Source : I survived healthcare.

Reply

[-]

ksmt@reddit

Somehow I miss working in healthcare IT, but it also completely destroyed me and I'm glad to be out of it.

Reply

[-]

Positive_Meaning1665@reddit (OP)

I hear ya! Half of me wants to start job searching and the other half wants me to stay. I learn a ton but the amount of unrealistic expectations and deadlines that come with it is insane.

Reply

[-]

Positive_Meaning1665@reddit (OP)

Thanks for replying. I never heard of imprivata. But I am going to learn about it!

Reply

[-]

sputnik4life@reddit

Imprivata is great. Be seated when they give you the price though

Reply

[-]

iknowkungfoo@reddit

Virtual CISO here. I have a healthcare client where I upgraded all of their company polices, implemented better security and HIPAA training, deployed 1Password, and a whole swath of other things. 1Password makes it very easy to group shared logins into Vaults and assign who can access them. The admin makes it very easy to recover individual accounts (which will happen often). You can set who has access to manage passwords in shared vaults and who can only read entries. The best is generating Watchtower reports that tattle on who is reusing passwords and who is using weak AF passwords. https://support.1password.com/hipaa/

Reply

[-]

DevinSysAdmin@reddit

You need to lock down chrome so personal accounts can’t be used, you also need to have a company provided password manager.

Reply

[-]

darthfiber@reddit

Block access to sites you don’t need, provide SSO on as many apps as you can, and provide users an official password manager.

Reply

[-]

Affectionate-Cat-975@reddit

GPO force password saving off except for company approved password manager app

Reply

[-]

Joker8656@reddit

My users don’t get a choice. Edge only, forced/auto SSO sign in. Can’t use any other accounts, locked down using every configuration profile known to man.

Reply

[-]

OrvilleTheCavalier@reddit

Lock external email out. No one in healthcare should be accessing personal email from work devices.

Reply

[-]

GardenWeasel67@reddit

You acted appropriately in my eyes, but it really depends on your company policies. In my org, you would have to fill out paperwork of what you saw, and then submit it to compliance team to handle. But our users also have extensive training on password use and storage, and know that password sharing is verboten. We also have non-enterprise email access blocked.

Reply

[-]

totmacher12000@reddit

It blows mind how environments like this lack basic security standards.

Reply

[-]

mtak0x41@reddit

I had to check this wasn’t r/shittysysadmin.

Reply

[-]

ItBurnsOutBright@reddit

Pony up to get them a real password management solution. This is a failing of IT.

Reply

[-]

p47guitars@reddit

IT can't always save users from themselves. These people could be doing stuff like this with their phones for all we know. Healthcare providers seem to be the most lackadaisical when it comes to operational security. Anything that inconveniences them in the slightest is seen as a mortal sin. 2fa / mfa - no time for that! They want to live in a world where erp signs in as soon as they look at the device, and they long for a no password solution to everything. They don't care. UVM med here in Vermont had one of the largest cyber attacks in my state, all because a so-called provider went on vacation with a company issued laptop, decided to look at their personal Gmail while connected to the VPN. Left my whole fucking state in shambles. All because they couldn't be bothered to check their email on their own phone or understand that a vacation means that it's a vacation. We need to stop coddling these users and hold them accountable for their transgressions. Operational security and basic IT security shouldn't be a far-fetched concept for somebody that has a degree and likes to condescendingly assert it.

Reply

[-]

GwentMorty@reddit

If it’s anything like the hospital I worked at, they all scoffed when I brought up purchasing a password management solution.

Reply

[-]

Jtrickz@reddit

There’s free ones. Keepass

Reply

[-]

GwentMorty@reddit

I appreciate the idea, but it wasn’t just the cost. I was told “admin and providers won’t want to do this.” I said that’s too bad it’s necessary for security but was shrugged off.

Reply

[-]

Kahless_2K@reddit

I love Keepass, but its not exactly something you would want to attempt to support for 10k users.

Reply

[-]

RaNdomMSPPro@reddit

This is a failing of ~~IT.~~ Management. FTFY IT doesn't make security decisions in a vacuum. Practice admin manages the annual HIPAA Risk Assessment - probably pencil whipped it, but possible didn't catch it, so this finding definitely needs to be on their current RA as a finding and then corrective action taken. IT can offer suggestions such as a good PW Manager. They also have to figure out how to put the genie back in the bottle. Assume any credential handed over to a free gmail account is no longer known only to that person. 1. Get good, business password manager 2. Set everyone up with access to this who handles credentials for the business. Yes, they need to use MFA. Yes, everyone needs their own license. 3. Move these now changed passwords into the pw manager. 4. While you're at it, find all the browsers w/ cached credentials - same steps apply. 5. Apply policies that block storing credentials in browsers. 6. Audit usage.

Reply

[-]

xSchizogenie@reddit

You did not overreact. In our company, people receive a warm from HR to keep business data away from personal accounts and we added Chrome GPOs to prevent people logging in accounts at all in browser.

Reply

[-]

ranhalt@reddit

This is how Cisco got hacked and data exfil last year.

Reply

[-]

yellowadidas@reddit

i have just kind of accepted that end users are going to be fucking stupid regardless. blocking them from doing it one way will just have them to do it in another way

Reply

[-]

g2g079@reddit

You might be in the wrong field.

Reply

[-]

g2g079@reddit

We can't even access Gmail at work. Do you offer an approved password vault? Otherwise, they'll just go back to postit notes.

Reply

[-]

hippychemist@reddit

There should be a company policy that's specifically addresses not storing sensitive data on personal accounts. Passwords count as sensitive data. Once you have a company policy, then you can implement a technical policy to prevent it. In the meantime, do you have any applications that they can safely store their passwords in? If you don't provide a solution to the problem, people will find their own solution

Reply

[-]

Ssakaa@reddit

There's 3 problems to address here. One, why were they *able* to do this? That's useful to fix just to ndge people towards a better option. Block as others mentioned, etc. Two, why *didn't* they approach IT with the original issue, or, if they did, *where* did IT drop the ball? This is way harder, and above your paygrade, but *great* practice. It's not a blame game, just an opportunity to figure out how to make people more likely to take the right path and avoid shadow IT. Third, they had an original problem. Sounds like they potentially fixed it a *really* smart way, despite the flaws, if they really did set up dedicated accounts for it et. al. Champion a better solution and work *with* them to test, approve, and migrrate. Preferably *before* implementing #1. And last, make it as blameless as possible, but do convey the risks, and why an appproved solution is better and needed.

Reply

[-]

Budget-Werewolf-7438@reddit

Don’t look at the last page in the notepad on their desk. Ignore those random letters and numbers written on that note stuck to their monitor. Do not lift up the keyboard, there’s nothing under it. Do IT security folks actually expect people to remember 20 different passwords?

Reply

[-]

CPAtech@reddit

Is there a policy in place about this? If not then they aren’t necessarily doing anything prohibited. Get a policy in place, deploy a password manager, block password saving in Chrome via group policy.

Reply

[-]

awnawkareninah@reddit

Put critical systems behind stronger auth than passwords. Problem solved.

Reply

[-]

Recent_Carpenter8644@reddit

How are they storing their passwords in their gmail accounts? In the Chrome password manager? I'm not very familar with it. Apart from the risk of someone else using their gmail account, how bad is this? Is it worse than, say, storing them in a personal Bitwarden account?

Reply

[-]

CVMASheepdog@reddit

Regarding overreacting. Look at the state of Nevada and others that have been compromised. Most likely at some point someone said "hey we should do this....." and were shut down. It is hard in today's world to overreact about security.

Reply

Reply to Post

108 Comments