I noticed last time I was at the IT office at my school that they asked for student's passwords. I think the student was either having the operating system re-installed, or the keyboard replaced, I can't remember for sure though. Anyways, the contract we have to sign to get access to the school network / school computers (which we're basically required to sign) says this (translated):
The password is personal and shall be kept secret. If a suspicion or knowledge of someone else gaining access to the password, the student shall change his or her password immediately.
The contract says nothing about this not applying if staff asks for your password, so I sent the following email to the school's IT staff (again, translated from Norwegian):
Last week I noticed that the IT staff at school encouraged students to breach the IT contract they've signed. A student was at the IT office (I can't remember why, but I think it was an operating system reinstall or a keyboard replacement), and was asked to write down her password on a sticky note. Under section 3, "User identity and password", the contract states the following:
The password is personal and shall be kept secret. If a suspicion or knowledge of someone else gaining access to the password, the student shall change his or her password immediately. I think this episode is a clear breach on the IT contract, and shows an unprofessional attitude towards security.
Regards, Henrik Hodne
Today, I got the following reply (translated yet again):
Hi! Normally you would be correct about giving away your password to others. However, when it comes to the IT staff things are slightly different.
We are able to change the passwords of all students and staff, and therefore we have a technical ability to access their resources.
We have therefore decided to let the student decide if they want us to change the password for them when we work on the machine, or if they wish to keep their password, in which case we write it down on a sticky note.
Regards, [Name of IT staff person], IT
What do you think I should respond? Should I just let it go? I still think it's wrong of them to ask for the password, even more wrong to write it down, and it has nothing with me being worried about them gaining access to my data.