5. Sharing a Password Without Sending It
Sharing a Password Without Sending It
Sooner or later you have to give a colleague access to something. How you do it matters more than most people think.
The rule
The login and the password never travel together, and ideally the password does not travel at all. A password manager can share an entry directly, so the other person gains access without the password ever appearing in a message.
If you must send it, use a different channel than the one carrying the username — for example the login by email and the password by text or a messaging app. We have seen this done correctly in the field, and it is exactly right.
During a handover at a construction company we found the departing IT contractor’s browser profile still signed in on a company machine. Inside it: the storage system administrator account, the Microsoft tenant, two domain registrars, the cloud provider and the backup service.
One browser profile held the keys to the entire company. That is what “just save it in the browser” looks like at the end.
Two habits worth keeping
- Shared accounts belong in the company vault, not in one person’s browser.
- When somebody leaves, shared passwords get changed — the vault shows you which ones.