As usual, I ignored the repeated reminder emails that my passwords on a number of systems were going to expire soon.  I get so much other email that I tend to see them and immediately forget about them.  So this morning I go to log on and get the message that I have to change my password now.  I always hate picking new passwords, because they’re such a pain.  Not only do I have to adhere to my company’s password rules, I have to be able to remember the damn thing.  I tried several and was growing increasingly frustrated at finding something memorable and “secure” (at least according to their rules).  Anyhow, I finally found something that would work and went into one of our support websites to change the password on six Unix systems all at once.  Except it did something I didn’t expect this time (something it’s never done in the past three years I’ve been using this system).  Whoever runs the system had changed it to send me an email with my new password in cleartext.  Normally, this is just annoying, but it’s not that big of a deal.

Unfortunately, the system also CC’ed my manager on the emails.  One email for each of the six systems.  Did I mention that my password used one of the seven words that are forbidden on TV and radio?  That made for an interesting phone call from my manager about ‘appropriate’ words for use in a business environment.  Of course, the fact that she was never supposed to see the password didn’t make much difference (managers are supposed to be copied on passwords for new accounts and for password resets, but not with user-selected password changes).

If I’d have known that anyone else would have seen the password that I might have chosen a different password selection algorithm.  Anyhow, I sent a nastygram to the support address for the password website.  Perhaps they can be pursuaded to adhere to the password rules before anyone else gets their wrists slapped for an ‘inappropriate’ password that is supposed to be kept private.