Re: Password Security

[Gene Spafford <spaf () CERIAS PURDUE EDU>]

Simplest argument?

If an employee has identity/assets/benefits stolen as a result of
theft of one of these cards, there is no shortage of experts who
could testify -- in a negligence lawsuit against the university --
that it is known bad practice to write sensitive passwords where they
can be found.  That could mean increased damages against the
university from any aggrieved employee.

Oh, and now that this threat is online, any aggrieved employees (or
their attorneys) will be able to find it to help identify said
experts and show that the university had prior notice.

So, as with any standard risk management, it is up to university
authorities to decide if it is worth the risk of losing a messy,
expensive lawsuit that might be enabled by their policy.

:-)