Sharing Passwords with a Contractor
May 9, 2024 12:22 PM Subscribe
I am working to make my business more marketable, so I've found someone who was recommended to me that does brand development and marketing.
We've had two meetings so far, and talked about strategies for building the brand imagery of my business as well as brand awareness thru social media, posters, etc. They seem to be someone I can work with. But they suggested, at some point, that I give them access to my passwords of social media and web hosting so they can do the work on the imagery, etc.
In this day and age, it probably shouldn't bother me because I imagine it's necessary, but it slightly scares me that someone has access to that stuff. Between the hacks that bring down whole networks, the hacks that deny service to individual websites and the hacks of disgruntled employees, I need to get over my fear, which is really mistrust. If our relationship goes bad, they could destroy all the work I've done alone and we might've done together.
Should I vett them more? Should I give them access in a more controlled way? IDK. Any suggestions for how I can deal with that anxiety, and if I am even seeing this situation correctly or not, would be appreciated.
We've had two meetings so far, and talked about strategies for building the brand imagery of my business as well as brand awareness thru social media, posters, etc. They seem to be someone I can work with. But they suggested, at some point, that I give them access to my passwords of social media and web hosting so they can do the work on the imagery, etc.
In this day and age, it probably shouldn't bother me because I imagine it's necessary, but it slightly scares me that someone has access to that stuff. Between the hacks that bring down whole networks, the hacks that deny service to individual websites and the hacks of disgruntled employees, I need to get over my fear, which is really mistrust. If our relationship goes bad, they could destroy all the work I've done alone and we might've done together.
Should I vett them more? Should I give them access in a more controlled way? IDK. Any suggestions for how I can deal with that anxiety, and if I am even seeing this situation correctly or not, would be appreciated.
I should say that I am not an expert in this stuff, but: do not give out your password! You are right to be concerned, even if the person doesn't seem shady. Once they have your password, they can log in and change your password, especially if you don't have MFA (multifactor authentication) enabled.
There may be ways of giving them access with fewer privileges, depending on the platform.
posted by number9dream at 12:32 PM on May 9 [1 favorite]
There may be ways of giving them access with fewer privileges, depending on the platform.
posted by number9dream at 12:32 PM on May 9 [1 favorite]
I think it's worth asking yourself whether you would be happy posting their contributions yourself. Ask your contractor how often updates to the various accounts would be posted, and then think about whether you would prefer to have your contractor supply you with text and images so you can post them yourself.
I don't do social media consulting, but I do build websites for clients. The password situation is different, but sometimes my clients prefer the convenience of providing me with a password to one of their accounts. I always, always tell them it's fine with me if they don't want to give it to me, I'm happy to do any work they need in a way that doesn't require me having a password, and if there's a way to set me up with my own separate access to their account that's better than sharing a password.
I think you're right to be reluctant to do this (it doesn't at all mean they're shady for asking! but you're absolutely right to acknowledge that it's a vector for something to go wrong). If you can find a way around it, maybe by posting the content yourself, that would be more secure.
posted by kristi at 1:00 PM on May 9
I don't do social media consulting, but I do build websites for clients. The password situation is different, but sometimes my clients prefer the convenience of providing me with a password to one of their accounts. I always, always tell them it's fine with me if they don't want to give it to me, I'm happy to do any work they need in a way that doesn't require me having a password, and if there's a way to set me up with my own separate access to their account that's better than sharing a password.
I think you're right to be reluctant to do this (it doesn't at all mean they're shady for asking! but you're absolutely right to acknowledge that it's a vector for something to go wrong). If you can find a way around it, maybe by posting the content yourself, that would be more secure.
posted by kristi at 1:00 PM on May 9
I would never give anyone the passwords to any of my accounts. Social media, website access, email, none of it. There's nearly always another way to do it. Facebook and most socials will let business profiles have "authorized posters" and such, who are allowed to post "as" a business, without giving them full, unlimited access to the control of the account.
Depending on how your website is set up, there's surely a way to allow them to contribute. If it's built on something like Wordpress, you can add them as a contributor with limited permissions. Even if the site is a collection of handwritten, from-scratch pages, you can create another FTP user account that they can use to upload, and then migrate the adds/changes yourself, after review.
The biggest reason I would never give someone my passwords is that this essentially lets them hijack the entire account, if they wish. Log in using your credentials, change the contact info, recovery email, etc, change the password and now you're shut out. And it's not just a matter of trusting them, as an individual, but you're also trusting that their computer isn't going to fall victim to malware or tampering by another user; this contractor could be the most trustworthy person in the world with only good intentions, but your very important user info could still wind up in the wrong hands, and you could lose your accounts.
posted by xedrik at 1:23 PM on May 9
Depending on how your website is set up, there's surely a way to allow them to contribute. If it's built on something like Wordpress, you can add them as a contributor with limited permissions. Even if the site is a collection of handwritten, from-scratch pages, you can create another FTP user account that they can use to upload, and then migrate the adds/changes yourself, after review.
The biggest reason I would never give someone my passwords is that this essentially lets them hijack the entire account, if they wish. Log in using your credentials, change the contact info, recovery email, etc, change the password and now you're shut out. And it's not just a matter of trusting them, as an individual, but you're also trusting that their computer isn't going to fall victim to malware or tampering by another user; this contractor could be the most trustworthy person in the world with only good intentions, but your very important user info could still wind up in the wrong hands, and you could lose your accounts.
posted by xedrik at 1:23 PM on May 9
It absolutely should bother you and as TheAdamist points out above, most platforms allow you to add users without giving them full admin privileges.
I would be extra careful about giving them access to your web hosting (and your website?) as this is the most important part of your online brand since it is the one you have the most control over (as opposed to e.g facebook or twitter).
Please make sure you have good up-to-date backups of your content before granting other people access. And when the job is complete make sure you delete any user accounts you created for the brand marketing contractor. (Oh and make sure you have an written agreement that spells out what you are giving him access to and for what purposes).
posted by lrm at 1:34 PM on May 9
I would be extra careful about giving them access to your web hosting (and your website?) as this is the most important part of your online brand since it is the one you have the most control over (as opposed to e.g facebook or twitter).
Please make sure you have good up-to-date backups of your content before granting other people access. And when the job is complete make sure you delete any user accounts you created for the brand marketing contractor. (Oh and make sure you have an written agreement that spells out what you are giving him access to and for what purposes).
posted by lrm at 1:34 PM on May 9
There have been some very sophisticated scams around social media credentials, so best be wary. Like others have said, most of the business level accounts give access to business suite tools that allow you to assign users and permissions - and more importantly remove users you don’t want in there anymore. A brand/marketing person should actually know this already, and should have presented this as an option before just asking for your login credentials.
posted by eekernohan at 4:01 PM on May 9
posted by eekernohan at 4:01 PM on May 9
Designer here: If you’re just getting started, password sharing is prob not necessary in the near term. Get all the concepting, strategy, writing, positioning and messaging done. You should see various mockups for specific deliverables throughout the process . By that time you should have a better sense of trustworthiness. If you’re comfortable, share. If not, execute the program yourself. In my firm we receive login credentials from virtually all our clients. From startups to investment firms.
posted by pmaxwell at 5:43 AM on May 11
posted by pmaxwell at 5:43 AM on May 11
« Older Where can I get Hungarian cherry soup (NYC)? | How should I attach this adapter to this lens? Newer »
You are not logged in, either login or create an account to post comments
Facebook: Assign Pages to people in your business portfolio | Help Center - Facebook as an example of one way to do this
If everything you have is personal type pages, you may have to share passwords, and of course with full control they can do whatever they want, nefarious or otherwise.
If you have 2 factor turned on, which you should, they may not be able to login anyway without your phone/whatever second factor that you can't share.
posted by TheAdamist at 12:31 PM on May 9 [7 favorites]