The Shared Password on the Office Wall

The note beside the monitor

At the front desk of many small businesses there is a sticky note on the edge of the monitor, with the website login, the supplier portal and the Wi-Fi password.

On the shared drive there is a spreadsheet called passwords, last tidied three years ago, with logins for everything from the domain registrar to the postage meter.

Five people use the same login for the website, and two people who left last year still know it.

Today is Safer Internet Day, which is as good a reason as any to take the note down.

Why shared logins stick

Nobody sets out to share passwords. It happens because sharing is the quickest way to let a new person cover a shift.

Some systems make individual logins awkward: they charge per user, offer only one account, or were set up by somebody who never added anyone else.

And once a password is shared, changing it means telling everybody, which is enough friction to make sure it never changes.

What a shared password costs

• No record of who changed what, since everybody is the same user.
• No clean exit, because removing one person means changing it for everyone.
• Weak passwords, since one written for six people has to be easy.
• Reuse, because an easy password tends to turn up on other accounts.
• Visibility to couriers, cleaners and anyone standing at the counter.
• No second step, since the code goes to one person's phone.

The last is the one that blocks everything else. Two-step verification sends its code to a phone, so a login shared by five people either goes without it or depends on whoever holds that phone today.

Individual accounts wherever possible

The best shared password is one that does not need to exist, and most systems a small business depends on can give each person a login of their own.

WordPress lets you create a user for each person, with a role that limits what they can change: an editor can update pages without being able to install plugins.

Google My Business has owners and managers, Facebook pages have roles, and Analytics has users, each tied to a person's own account.

G Suite and Office 365 can both let several people work from an info address without anybody knowing its password.

A password manager for the rest

Some logins will stay shared: the domain registrar, a supplier portal with one account, the hosting control panel. Those belong in a password manager.

A password manager is an encrypted vault. Each person has their own login to it, and the business shares folders of passwords with the people who need them.

It generates long random passwords and fills them in, so staff rarely need to know them. Some can share a login without showing the password at all.

Business versions of the well-known ones cost a few dollars per person per month. The account should belong to the business, with two people able to run it.

Retiring the spreadsheet

Moving everything across takes an afternoon, and it has one rule: change each password as it goes in.

The spreadsheet has been copied, emailed and backed up for years, so every password in it should be treated as known. Moving one across unchanged just stores a compromised password more tidily.

Then delete the spreadsheet, empty the recycle bin, search the email for copies sent as attachments, and take down the sticky note.

There are usually others: a notebook in a drawer, a note on somebody's phone, a page taped inside a cupboard door.

A worked example

A veterinary clinic with five people on its front desk shared one login for the website, one for the online pharmacy portal, and one Gmail address that controlled its Google listing.

The passwords lived on a sticky note and in a spreadsheet, unchanged since the clinic opened, and several former staff still knew them.

It came to light when a former receptionist mentioned, kindly, that her phone still logged her into the clinic's website, because her browser had saved the password.

Nothing had been misused. But nobody could say who else had access, and the honest answer was anyone who had worked the front desk since 2015.

Each person now has their own website login with an editor role, and the listing belongs to the clinic's G Suite account, with two owners. Everything else went into a password manager, changed on the way in.

When somebody leaves

The day somebody leaves is when shared passwords do their damage, because changing them is the job nobody gets round to.

With individual accounts it is quick: disable theirs, remove them from the password manager, and change anything they could see, which the manager can usually list.

Check the recovery details too. A former employee's mobile number, left as the recovery phone on a business account, can undo all the rest.

And sign them out of business email on their own phone, which G Suite and Office 365 both let an administrator do.

The Wi-Fi password

The Wi-Fi password on the wall is a slightly different case, because customers need it too.

The answer is two networks: a guest network for customers, whose password can go on the wall, and a staff network, whose password never does.

Most business routers can do this, and it keeps the office computers and printer apart from whatever customers bring in.

The counter-case

Some businesses have less to do here.

A sole proprietor has nobody to share with, and needs a password manager mainly so that every password can be different.

Some systems really do allow only one login. For those, the password lives in the manager, with a note of who can see it, and changes whenever one of them leaves.

And one written password is sensible: the emergency details for the password manager itself, sealed and locked away.

For everyone else, the sticky note comes down this week, and nothing goes back up in its place.

This month

1. List every shared login in the business.
2. Give people their own accounts where systems allow.
3. Choose a password manager with team sharing.
4. Change each password as it moves in.
5. Delete the spreadsheet and every copy.
6. Set up a guest network for customers.
7. Write the leaving checklist before anyone leaves.

Step four is the one people are tempted to skip, and the one that makes the move worth doing. A password everybody has seen for years is no safer in a vault than on a sticky note.

Adding a second step to the logins that matter most is covered in two-step login, starting with email.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.