In a new expression of intimacy, young people increasingly exchange passwords to various online sites, email and instant message accounts, Facebook pages, even sometimes bank accounts.
The New York Times has reported that for some teens, the password has become a measure of trust — the digital version of a promise ring or a letterman's jacket. A Pew study last year found that roughly one third of teens report sharing passwords, most of them girls.
And the phenomenon is hardly limited to females or the young, as many married couples also share access to online accounts. In a piece in Gizmodo, staff writer Sam Biddle called password sharing "a linchpin of intimacy in the 21st century."
But what might seem like an innocent expression of love and trust — or even efficient household management — can have some risky consequences, especially if the relationship sours.
NPR's Neal Conan speaks with Biddle and Woodrow Hartzog, assistant professor of privacy law and online agreements at Samford University, about the social and legal risks associated with password sharing.
Interview Highlights
On how password sharing between couples can go wrong
Hartzog: "A lot of people feel as though they have nothing to hide from a friend or from a spouse or a romantic partner. And so they share, thinking 'I'm an open book.' But I think that it's significantly more complicated than that."
Biddle: "Everything seems like a good idea when you're in the relationship. ... You love each other, and you trust each other, and it can seem like this pure symbol. But once [the relationship is] over, it's a huge liability ...
"Anecdotally, there are people close to me who have been in relationships [and] shared Facebook passwords. And ... it seems like this incredibly bold symbol of mutual trust. ... And then once it's over, they go in and start deleting things and reading things. ... The worst of you comes out, and you have unmitigated access to someone else's personal life — and an ex's personal life, at that."
Hartzog: "[When] you give your friend access to see and use personal information ... what we don't often think about is that you're also giving your friend access to other people's information that was sent to you — that may have been intended for your eyes only.
"You risk getting locked out of your account because someone else has the password and can change it, and you wouldn't know it. And you also give someone a very credible means to impersonate you."
On the risk of innocent exchanges being misunderstood by a romantic partner
Hartzog: "We hear a lot of people say, well, I can let anyone read my email. I don't have anything that I would be embarrassed about.
"But the real threat doesn't come with a secret coming through email but rather information that's being taken out of context. And so if you're not there to explain what this email meant, then perhaps it'd be misinterpreted and could lead to problems."
On the varying levels of risk associated with different websites
Biddle: "A big part of [sharing] is knowing where to draw the line, you know, which is the case in any relationship with a lot of things. But, say, the Netflix password is not quite on the same tier as the Facebook or email password. Not all passwords are created equally, and they allow for much, much different levels of access. ...
"[And] if your girlfriend is asking you — or boyfriend is asking you — for the password to your bank account, you might want to look into [an] identity theft service or something. That's bizarre to me."
There are so, so, so few things online that are left to ourselves: Our locations are shared, the meals we eat are shared, our photos, our vacations — everything is public. The inbox is one of the few things left that I think we can have to ourselves.
On the value of keeping one's digital life personal
Biddle: "There are so, so, so few things online that are left to ourselves: Our locations are shared, the meals we eat are shared, our photos, our vacations — everything is public. The inbox is one of the few things left that I think we can have to ourselves, and rightfully so. And I would urge people to cling to that, no matter how romantic it might seem to do otherwise."
On the legal risks of password sharing
Hartzog: "All of these things can have legal consequences, the least of which might be violating the terms of service on most websites. ... There are varying degrees of severity with regard to punishment, but most major email providers and most social network sites all explicitly prohibit sharing your username and password.
"They also explicitly prohibit ... logging in with someone else's username and password, and so the person giving away the password stands to lose access to their account, and the person using someone else's username and password could also lose their account.
"And for the person who is using another's username or password ... there is a bevy of things that you could potentially fall prey to under the law that you might not know about if you start making posts under someone else's profile ...
"And under some theories, if you're using — if you're accessing someone else's website using their username and password, you might actually violate federal law. ... There was a statute called the Computer Fraud and Abuse Act that was originally intended to stop hackers, but it's written so broadly that it could apply to people who access websites in violation of terms of service agreements — which people that use other people's username and passwords potentially do."
On the risks to parents when their children share passwords
Hartzog: "As a parent, you need to watch out with regard to whether your children are sharing user names and passwords. Because ultimately a lot of that may come back onto you, as far as responsibility. As a teenager, you're not technically allowed to enter into certain contracts that aren't viable, and so that's you [the parent] that is in charge of that."
On the lack of clear laws when it comes to password sharing and digital devices
Hartzog: "We are still trying to figure out how to deal with passwords and usernames, because we don't know exactly what that means. I mean, what does it mean to give someone a username and password?
"We've run into certain areas of the law — for example, if you lock your phone and you give it to a friend, does your friend have the right to consent to letting the police search your phone because they know your password? And is that something that you've given? And so we're still on a very unsettled stage of the law at this point."
Copyright 2020 NPR. To see more, visit https://www.npr.org.
