A shared counter computer that saves passwords hands the website, the banking and the email to anyone who sits down. Give each person their own login, keep important passwords in a password manager, and lock the screen.

The computer behind the counter

Most small shops have one: the computer behind the counter that everybody uses.

Over the years it has been asked to remember the website login, the business email, the supplier portals and, quite often, the online banking. Each time the browser offered to save a password, somebody clicked yes.

Now anyone who sits down is signed in to everything. The part-time employee, the relative covering a shift, the technician who came to fix the printer.

Nobody planned it. It is what happens when one machine is shared and saving is the default.

What a saved password gives away

A browser that remembers a password does more than fill in a box.

The third turns a small problem into a large one. Whoever can read the business email can request password resets for the website, the domain and the social accounts, and receive every one.

Why a counter is riskier than an office

In an office, each person usually has a desk and a computer of their own. At a counter, the machine is shared by design, and the screen is often visible to customers.

It is also left unattended at the worst moments, during a rush, when everyone is out on the floor.

And staff change more often. Seasonal and part-time employees come and go, and nobody changes the passwords when they leave, because nobody knows which ones they saw.

Give each person their own login

Windows and Mac computers both allow several user accounts, each with its own desktop, browser and saved passwords.

Set up one account for the owner or manager and one for counter staff. The staff account gets what the counter needs, the point-of-sale software and the order screens, and nothing else.

The owner's account holds the banking and the website administration, behind a password nobody else knows.

The website itself should work the same way. Give each person who updates it a login of their own, so one person leaving means removing one account, not changing a password everyone shares.

A password manager instead of the browser

Saving passwords is not the problem. Saving them where anyone can use them is.

A password manager is a program that keeps passwords in an encrypted vault, opened with one master password. It fills in logins much as a browser does, but only once the vault is open.

It can also create a long, different password for every site. That matters, because a password reused across sites is only as safe as the weakest site it is used on.

For a business, the useful part is sharing. Most password managers built for teams let you give a person access to a login and take it away again, in one place.

A worked example

A lighting store with five part-time staff had one computer behind the counter, used for the point-of-sale system, the online shop and the store's email.

The browser had been saving passwords for three years. It was also signed in to the personal account of a former manager, who had set the computer up and left the previous summer.

Nothing bad had happened. The owner found it while looking for the email password, and noticed the browser offered every login the store had ever used, the bank's included.

The fix took an afternoon. The saved passwords were deleted, the browser was signed out of the former manager's account, and every important password was changed, starting with the email.

The computer got two user accounts, the owner's logins moved into a password manager, and each staff member got a separate login to the online shop.

The screen now locks itself after a few idle minutes, and everyone was shown how to lock it on purpose.

Change the email password first

If a shared computer has remembered passwords for years, assume they have been seen, and change them in order of what each one gives access to.

Email first, since it can reset everything else. Then banking, the domain and hosting accounts, the website, and the social accounts.

Switch on two-step verification wherever you can, starting with email. Signing in then takes a code from your phone too, which a thief with only the password does not have.

Change them one at a time, and store each new one in the password manager as you go.

Lock the screen

The simplest habit costs nothing.

On Windows, the Windows key and L together lock the screen at once. On a Mac running the latest macOS, Control, Command and Q does the same.

Set the computer to lock itself after a few minutes without use, so stepping away to help a customer does not leave everything open.

The habit takes a week or two to form, and staff pick it up faster when the owner does it too.

Keep banking off the counter

Some things should not happen on a shared machine at all.

Online banking is the clearest case. A computer that customers stand beside and staff use for everything is the wrong place for it, however carefully it is managed.

Use the owner's own computer, or an account nobody else signs in to, and never let the browser remember the banking password.

The same goes for the domain registrar and the hosting account: rarely needed, and very costly in the wrong hands.

The counter-case

A business of one person, or two partners who share everything, has less to separate. The shared computer is really their own.

A counter machine that runs only the point-of-sale software, with no email or browsing in daily use, may not need a second account at all.

A password manager is also one more thing to learn, which is why many owners never start. An hour spent setting it up properly with someone who knows it gets past that.

But wherever several people share a keyboard, the important logins should not be available to whoever happens to sit down.

The afternoon to do it

  1. List every login the counter browser remembers.
  2. Sign the browser out of personal accounts.
  3. Change the email password first.
  4. Turn on two-step verification for email.
  5. Create separate user accounts for owner and staff.
  6. Move important logins into a password manager.
  7. Set the screen to lock by itself.

Step three matters most. Email is the master key: whoever controls it can reset almost every other password the business has.

Keeping the computer itself patched is covered in Meltdown, Spectre and the server under your site.

Frequently asked questions

Is it safe to save passwords in the browser?

On a computer only you use, with its own login, it is reasonable. On a shared counter machine, saved passwords are available to anyone who sits down.

Can other people see saved passwords?

On many machines, yes. A browser's settings can display saved passwords in plain text, especially on a computer without a login password of its own.

What does a password manager do differently?

It keeps passwords in an encrypted vault opened with one master password, creates a different password for each site, and lets a business grant and remove access in one place.

Which password should we change first?

The email password, because whoever controls the business email can reset most other accounts. Then banking, the domain and hosting, the website, and social accounts.

Why set up separate user accounts?

Each account has its own browser and saved passwords, so counter staff get what the counter needs and the owner's banking and website logins stay out of reach.

Should banking happen on the counter computer?

No. Use the owner's own computer or an account nobody else signs in to, and never let the browser remember the banking password.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

One computer behind the counter for everything?

We can set up separate accounts and a password manager, and change the important passwords in the right order.

Start a Conversation