Passwords...don't get me started.

Until my job was recently outsourced, I used to work for a large IT concern, in a part of the business where employees would daily access dozens of different systems, including some customers' (supposedly) highly secure systems. Password changes were enforced, on most of the systems, between 30 and 90 days. My list of passwords had 27 userids/passwords. On average, employees spent a significant part of their work week hampered by, and restoring, expired passwords. For the sake of expediency, it was not uncommon to just borrow passwords from a co-worker for an urgent task. Because of the long list of passwords and frequent changes, many employees kept a list of their main passwords written on the back of their ID prox card. Furthermore, the ID card lanyards that the company provided had cheap plastic clasps that would break easily, so it wasn't unusual for someone to come back from lunch and find that they'd lost their prox card, with password list, on the street somewhere. We had to regularly take online security courses from corporate headquarters reminding us about the importance of password security, but our managers would be the first ones to violate regulations by demanding a subordinate's password to access a system.

In an attempt to improve security (or rather give our customers the IMPRESSION of improved security) HQ instituted the use of an online password vault system. We would have to log in to the vault at the beginning of our shift and "sign out" some of the passwords and sign them in again at the end of the shift. The sign-in/sign-out procedure was tedious and time consuming, taking a minimum of 3-5 minutes, four times per day, assuming the connection to the vault was not slow. The odd thing was that the vault system did not give you the password. The passwords were not uniquely assigned when you signed them out, i.e. they didn't change - you just signed out the authority to use them. One person on each shift would sign them out, but everybody knew and used them; and not signing them out did not prevent you from using the system in question, it would just bring a reprimand from the supervisor. The only function served by this vault system was to pre-assign a scapegoat for the convenience of corporate security officials in the case that any security issue occurred.

When we were first forced to begin using the system, we tried to explain to our supervisor the pointlessness of the system, because it did not actually supply the signer-out with password, and did nothing but add another pointless task to our long list of other pointless tasks. He basically said, "Shut up and do it". Then after three years of us pointlessly signing out passwords, he was tasked with learning our jobs in preparation for our jobs to be outsourced. When we showed him the procedure of signing out the passwords, he said "This is pointless because the vault system doesn't give you the password ... the passwords don't change from one sign-out to the next! <in the background a chorus of heads was heard banging on desks>"