NEAL CONAN, HOST:
This is TALK OF THE NATION. I'm Neal Conan, in Washington. In a new expression of intimacy, young people increasingly exchange passwords to various online sites, email and instant message accounts, Facebook pages, even sometimes bank accounts.
The New York Times reported recently that for some teens, the password has become a measure of trust, the digital version of a promise ring or a letterman's jacket. A Pew study last year found that roughly a third of teens report sharing passwords, most of them girls, but the phenomenon is hardly limited to females or the young or to romantic relationships.
But what might seem like an innocent expression of love and trust can have some risky consequences, especially if the relationship sours. If you've shared a password, what happened? 800-989-8255. Email email@example.com. You can also join the conversation on our website. Go to npr.org. Click on TALK OF THE NATION.
Later in the program, how do we remember the stained legacy of Penn State coach Joe Paterno? You can email us now. That address again is firstname.lastname@example.org. But first passwords, and we'll begin with a caller, and Kirk's calling us on the line from Syracuse.
KIRK: Hi, yeah, thanks for taking my call.
KIRK: My girlfriend and I have shared all of our passwords for Facebook, email, and I think it adds a certain level of trust to our relationship.
CONAN: So you can be aware of every message she sends and vice versa?
KIRK: Correct, and then it also helps if she needs to pay a bill online for me, she can access my email and my credit card account, or if I need to help, like, with her the DMV or other things like that, also.
CONAN: And I can understand to some degree what you're talking about is the convenience. Do you not feel vulnerable?
KIRK: Not with her, no, and I raised the issue of possibly breaking up or whatever. The passwords are so easily changed now that it shouldn't really be much of a factor.
CONAN: Credit card numbers are less easily changed.
KIRK: Correct, but there's other recourse for that, as well, too.
CONAN: Is part of it - and forgive me, but - is part of this idea that you've got her email account, she's got yours, so if she did something terrible, you could do something terrible back, mutually assured destruction, if you will?
KIRK: That thought's never actually crossed my mind. It's more of a positive relationship than that - so no, I don't think so.
CONAN: All right, Kirk, thanks very much for the phone call, good luck.
KIRK: Thank you, have a nice day, bye.
CONAN: Joining us now is Sam Biddle, staff writer with the tech news site Gizmodo.com. He joins us from our bureau in New York. Nice to have you with us today.
SAM BIDDLE: Thanks for having me, Neal.
CONAN: And you've been quoted as saying in every instance you've ever heard of where passwords were shared, people came to regret it.
BIDDLE: Yeah, I really wish Kirk the best of luck, but everything seems like a good idea when you're in the relationship, and, you know, you love each other, and you trust each other, and it can seem like this pure symbol, but once it's over, it's a huge liability.
CONAN: Well, give us some examples.
BIDDLE: Well, I mean, anecdotally, there are people close to me who have been in relationships, shared Facebook passwords like the caller mentioned. And, you know, it seems like this incredibly bold symbol of mutual trust, like he said. And then once it's over, they go in and start deleting things and reading things, and, you know, your - the worst of you comes out, and you have unmitigated access to someone else's personal life, and an ex's personal life at that.
CONAN: But what about that argument Kirk also made, these passwords are easily changed?
BIDDLE: They are, but I - you know, I would question his - the claim that, you know, it's a symbol of a positive relationship to begin with. I think that our species got along for a very long time being in love without knowing one another's passwords. I think that you shouldn't rely on that for trust.
CONAN: And there are also, I think, as you pointed out in one of your pieces, there are different levels. One site may be a lot less important than another.
BIDDLE: Absolutely, yeah. I think a big part of it is knowing where to draw the line, you know, which is the case in any relationship with a lot of things. But, say, the Netflix password is not quite on the same tier as the Facebook or email password. You know, not all passwords are created equally, and they allow for much, much different levels of access.
CONAN: And then you get to the, I guess, ultimate level of the credit card number and the bank password.
BIDDLE: I would hope that would never be - I really hope - I'm not sure why that would be on the table to begin with. But yeah, I think if your girlfriend is asking you or boyfriend is asking you for the password to your bank account, you know, you might want to look into, you know, identity theft service or something. That's bizarre to me.
CONAN: Let's see if we can get some more callers in on the conversation, 800-989-8255. Email email@example.com. Sam(ph) is on the line from Ann Arbor.
SAM: Hi, Neal, thanks for allowing me on your show, love the show.
CONAN: Sure, thank you.
SAM: I share quite a few of my passwords, basically everything except for my banking password. I no longer use Facebook, so it's not an issue. But that is one I would have guarded against in the past, as well. Denard Robinson had his Twitter password stolen by his ex-girlfriend, who posed things falsely, and possibly true, as well.
(SOUNDBITE OF LAUGHTER)
CONAN: Well, there lies the rub, possibly true.
BIDDLE: No way to know.
SAM: But yeah, no, I follow him on Twitter, so that happened very briefly after he broke up with her, and she made a few claims. I don't know if the tweets - the tweets are probably on an image file saved by somebody somewhere.
But, you know, other passwords like say Netflix or if you are a video-gamer or something like that, like Steam or some other online program that doesn't have direct access to your credentials, you know, those I - it's like loaning someone my car. You know, it's the same level of trust for me. If I would loan someone the car, then yeah, you can have my password for my Netflix. Just watch it. You know, if I'm watching, it'll kick you off.
CONAN: So you do have boundaries, not your bank account, not - what about your email?
SAM: My email, you know, it's like I have nothing to protect. You know, I'm poor. There's not really much to steal. Nor do I think any of my friends would do that. But, like, even amongst those people, there's only like two or three people that I've known for some 20-odd years that know my email password.
So technically it's shared, but it's not something that I just, you know, it's not like oh, yeah, here's my email password, you know, just check it out. But it's not something that I consider sacrosanct, you know, like access to my direct finances.
CONAN: I get you. And thus far, nothing has gone wrong?
SAM: No, I mean, I have had the opportunity to have things go wrong with ex-girlfriends, but I didn't give them the password to my Facebook at the time. So I avoided that one.
(SOUNDBITE OF LAUGHTER)
CONAN: Sam, thanks very much for the call.
SAM: Thank you very much for having me, have a wonderful day.
CONAN: And Sam, there's another Sam, Biddle, our guest from Gizmodo, you have one short phrase about the question of email passwords: no, never.
BIDDLE: Absolutely. There are so, so, so few things online that are left to ourselves. Our locations are shared. The meals we eat are shared. You know, our photos, our vacations, everything is public. The inbox is one of the few things left that I think we can have to ourselves and rightfully so. And I would urge people to cling to that, no matter how romantic it might seem to do otherwise.
CONAN: Let's go next to Joe(ph), and Joe's on the line with us from Nashville.
JOE: Hey, thanks for taking my call.
CONAN: Go ahead, please.
JOE: So I fell victim to this exact thing yesterday, and it's really frustrating. In our house, my girlfriend and I, we share passwords, PIN numbers for cards and things like that, and we just had this - I leave my computer open, I leave my email up, I leave my Facebook up, and she does the same. We leave everything open. It's sort of, it's there, but we don't necessarily need to access it, you know, ever, because it's open.
And yesterday, I left the house for about, I guess, 30 minutes or so, and her brother was over, and he opened my computer and started going through my messages, and he read them aloud to her, and she let him continue to read them. And so I come home, and I find that my whole house and my whole life is in a completely different state than when I left, and she is frustrated with me because she feels like I betrayed her trust with some of the messages that I had sent.
So at the same time, I don't know how to reconcile my own feelings of my trust being violated because I just - I feel like I have no protection in my own home now. It's so, so, so frightening and so hideous.
CONAN: Have you changed your passwords?
JOE: I have not. I don't see the point much now anymore. It's - it's like you're in the middle of the ocean in a boat, and your sails are gone. And so you just drift. You have nothing - you have nowhere to go, nowhere to hide. You have no privacy.
CONAN: Sam Biddle, I guess this is the case in point.
BIDDLE: I was about to say the same thing. Yeah, I mean, I'm sorry to hear that, but it's more common than you would think. It's exactly the reason why I would never advise anyone to do that. You know, and once you're in there, the temptation to keep going and going and going, like the girlfriend's brother did, can be insurmountable.
CONAN: It sounds like the modern-day equivalent of exchanging keys to your apartments. That can also pose problems.
BIDDLE: Right, exactly.
CONAN: Joe, thanks very much for the call, appreciate it.
JOE: Thank you.
CONAN: This from Sara(ph) in Salt Lake City, who emailed us: My husband's password for everything was a variation of the date for our first date. So when he told me, I knew things were serious. Well, there's the romantic part of it.
CONAN: There is that sense, the article that we mentioned in the New York Times said that at least for some teenagers, it's a little like the pressure to have sex in that if you trust me, everything of mine will be everything of yours.
BIDDLE: You know, I think it says a lot that most people my age or younger are more willing to have sex with one another than to share a password to Netflix. You know, the password, I think, you know, despite the horror stories you might be hearing, is one of those last few hesitant areas in intimacy, at least when it comes to something beyond - Netflix is usually fair game, but something like Facebook or an email account, that's a serious, serious gesture.
CONAN: A listener who asked to remain anonymous emailed: I think the entire issue of social networks carries relationship tensions that have come on us fast and furious. In a gentler time, we were allowed a certain amount of privacy without having to call it out. Now with constant access to us via smartphones, Twitter, Facebook and the like, we are put upon to explain or put up boundaries that never had to be mentioned before.
Even at an adult age, I found this to be a touchy issue with my boyfriend. Who are the people friending you and why, to put it bluntly? And I guess those are questions we all have.
BIDDLE: Yeah, well, and, you know, right. In an earlier era, no one would have ever had to defend themselves if they were asked who - you know, give me a list of everyone you're talking to and how recently you talked to them and what you said. That would have never been an issue.
And now, you might be faced with the potential to look like you're hiding something, or your partner is paranoid if you say no. And, you know, it's ridiculous. You shouldn't have to account for that level of deepest personal privacy.
CONAN: We're talking about swapping passwords. In a few minutes, could it be a crime to give someone else access to your accounts? We'll talk with a lawyer. If you've shared a password, what happened? Give us a call, 800-989-8255. Email us, firstname.lastname@example.org. Stay with us. I'm Neal Conan. It's the TALK OF THE NATION, from NPR News.
(SOUNDBITE OF MUSIC)
CONAN: This is TALK OF THE NATION, from NPR News. I'm Neal Conan. The cardinal rules of passwords seem to be: Pick a strong one, don't use the same password on multiple sites, never share your passwords with anyone, advice many decline to follow.
As we've heard, teens swap passwords as a sign of trust in a relationship. Husbands, wives, friends, even co-workers ask others to sign on for them, often with little thought about potential consequences.
If you've shared a password, what happened? 800-989-8255. Email us, email@example.com. You can also go to npr.org, click on TALK OF THE NATION to join the conversation on our website.
Our guest is Sam Biddle, a staff writer at Gizmodo.com. We've posted a link to his column "When to Give Your Girlfriend Your Password." That's all at npr.org as well. And let's go next to Ryan, and Ryan's with us from Long Island.
RYAN: Hi, how's it going?
CONAN: Go ahead.
RYAN: So I actually kind of have the opposite view of this. I think once a significant other asks for a password, then they don't trust you, and then they have something - they think they have something to look for. And, you know, when passwords aren't exchanged, then it's more of a sign of trust 'cause it's like I don't really need to know because I trust that nothing's going on.
CONAN: And do you speak from experience here?
RYAN: I do. I mean, my last relationship, the girl I was dating, she - it was almost required. She's like, I want your password to email and Facebook. And I was like, well, I don't really have anything to hide, so whatever, you can have it. But then it got - it was like, you know, she was - apparently she was on mine when she was on hers, and it was kind of annoying.
And now I'm in a relationship where it's a big fresh of breath air, you know, we don't exchange passwords, but we don't need to, we both trust each other. And, I mean, small stuff. If I was like oh, hey, I forgot to do this, can you, I don't know, go on my Netflix account like mentioned earlier or small stuff like that, or like, hey, can you look at directions on my phone, this is my key to get on.
But, like, there's never any, like, doubt or mistrust where someone thinks they need to ask for a password to look.
CONAN: It's that demand, Sam Biddle, that you give me yours, I'll give you mine.
BIDDLE: Absolutely. I mean, think about an offline analog of this we might have faced a few decades ago. It would have been bizarre to say, hey, you know, is it all right if I go through your closet, or I send a private investigator to follow you around the clock. Like, you have nothing to hide, right? You know, that would be bizarre, very creepy behavior.
This is - asking to be in someone's Facebook account is the same thing, only it seems so benign because, you know, it's ubiquitous. But yeah, that demand itself shows that there's something already very wrong with that relationship. It should be a given that you don't have anything to hide.
CONAN: Ryan, thanks very much, and good luck.
RYAN: Thank you.
CONAN: Here's an email from Betsy in Cincinnati: I shared passwords with my ex-husband, never again. When I went through my nasty divorce, I had to change everything, and I feared for my privacy because of the shady situation surrounding my divorce.
On the other hand, my sister, who is my roommate, knows my passwords, and I have no fear in her case because, well, she's my sister. I know she'd never do anything horrible with my personal info like an ex would.
Woodrow Hartzog is an assistant professor who focuses on privacy law and online agreements at the Cumberland School of Law at Samford University in Birmingham, Alabama, and joins us from a studio in Homewood, Alabama. Nice to have you with us today.
WOODROW HARTZOG: Thank you for having me on, Neal.
CONAN: And there is a question that we haven't raised yet, and that's the little box that you sign when you sign up for Facebook or an email account or just about any other website, where you agree to terms of service. As far as I know, I've never met anybody who ever read those words.
HARTZOG: That's right. They're almost uniformly not read, yet they have some really important things in there.
CONAN: And so sharing of a password might be, in some cases, well, open you to liability.
HARTZOG: That's correct. There are actually - we've heard so far that a lot of people feel as though they have nothing to hide from a friend or from a spouse or a romantic partner, and so they share, thinking I'm an open book. But I think that it's significantly more complicated than that.
There are actually four different things that have legal consequences that can occur when you give your user name and password to a friend. The first, of course, is what we've been talking about, which is you give your friend access to see and use personal information, but what we don't often think about is that you're also giving your friend access to other people's information that was sent to you that may have been intended for your eyes only.
You risk getting locked out of your account because someone else has the password and can change it, and you wouldn't know it, and you also give someone a very credible means to impersonate you.
And all of these things can have legal consequences, the least of which might be violating the terms of service on most websites.
CONAN: So at the very least, you're risking getting thrown off of Facebook or closed out of your email account, but perhaps if someone, for example, who has your password misuses the information, are you liable?
HARTZOG: Well, that's - that is a scary possibility. You are giving someone basically kind of an authority, right - it's not just that you're allowing someone to see information, you're giving them - we've used the analogy the keys to the car. And so you probably wouldn't be liable under a number of theories - it's difficult to talk about this in the abstract - but you certainly risk losing your Facebook account, for example, and that's no small issue in today's world.
And for the person who is using another's user name or password, then there is a bevy of things that you could potentially fall prey to under the law that you might not know about if you start making posts under someone else's profile.
CONAN: Are there different rules that apply to different devices? I mean, for example, a password, user name - a Facebook user name and password, but then there's the code, for example, for a phone.
HARTZOG: No, I think that the laws would pretty applicably apply throughout. So there are varying degrees of severity with regard to punishment, but most major email providers and most social network sites all explicitly prohibit sharing your user name and password.
They also explicitly prohibit using someone - logging in with someone else's user name and password, and so the person giving away the password stands to lose access to their account, and the person using someone else's user name and password could also lose their account.
And under some theories, if you're using - if you're accessing someone else's website using their user name and password, you might actually violate federal law.
CONAN: Violate federal law. We're talking criminal penalties?
HARTZOG: Well, that's the theory, and it's been asserted in a number of cases. There was a statute called the Computer Fraud and Abuse Act that was originally intended to stop hackers, but it's written so broadly that it could apply to people who access websites in violation of terms of service agreements, which people that use other people's user name and passwords potentially do.
CONAN: And I guess if you gave somebody your credit card number, and they used it to buy stuff without your permission, well, then you're edging towards theft.
HARTZOG: Yes, right, and so simply by giving someone a credit card number, that doesn't necessarily mean that every single charge that's then put on that credit card is going to - you're going to be on the hook for. A court would likely look and see, well, what did you intend when giving away this user name and password.
CONAN: Possibly not that new Ferrari.
HARTZOG: Probably not that new Ferrari. So for example, if you gave someone your credit card number to buy the groceries, then the Ferrari is probably not going to cut it.
CONAN: Now, what are the implications - as we've suggested, a lot of these people who do this are teenagers and maybe not - may be still minors. Are there implications for parents?
HARTZOG: Yes, there are. I think that you really need to - as a parent, you need to watch out with regard to whether your children are sharing user names and passwords, because ultimately a lot of that may come back onto you as far as responsibility.
As a teenager, you're not technically allowed to enter into certain contracts that aren't viable, and so that's you that is in charge of that.
CONAN: I see, OK. Let's see if we can get another caller on the line. This is Wendy, Wendy with us from Grand Rapids.
WENDY: Hi, I would just like to say that my husband and I have been married for just over 20 years, and we never share passwords or PIN numbers or anything. However, if I ever felt the need to read his email or vice versa, I would feel perfectly comfortable asking him, you know, to open it for me and let me read his email or anything along those lines.
CONAN: But as a practical matter, you just don't?
WENDY: We just - yeah, we just don't. And we don't feel like it's a, you know, it's a trust issue. Like the one caller said earlier, you know, if you were to ask me for it, then, you know, it would feel like he doesn't trust me, and I would resent that. I do value my privacy, and I'm a bit of a control freak, and I don't like the idea of someone else having, you know, control over my account.
You know, they could lock me out, and even though we've been married 20 years, you never know. I mean, he might be plotting to divorce me and, you know, just could close my accounts, you know, close me off to my accounts, change my passwords, do all these things, and I could find out, you know, when it's too late.
CONAN: Yeah, I guess so. Well, Wendy, good luck.
WENDY: All right, thank you.
CONAN: Thank you, this email from Kelly in Jacksonville: I exchanged passwords with my late husband before we were married, when we were living together. He died five months after we were married. And having those passwords made settling his affairs a lot easier.
And, Woodrow Hartzog, that's probably true.
HARTZOG: Yes, that's true. I think that there is a certain utility to having someone like a spouse's passwords, usernames and passwords. But as a general rule, I would exercise extreme caution in sharing any kind of a username and password.
CONAN: Linda(ph) in Portland, Oregon, wrote along the same lines: When my dad passed away, getting into important accounts was challenging. Fortunately, he noted quite a few of them - but not all - for my mom shortly before he died. Since then, everyone in my family's agreed to keep a list of their passwords for each other in case of emergency. I hope they don't keep it in plain sight.
And this from Judd(ph) in Dallas: At first I wanted to write in and ask why TOTN decided it's important to talk about the insignificant topic of sharing passwords. Now I think I'll be changing all of my passwords.
Sam Biddle, yes, I think that there are perhaps some legal, potential legal problems, but I think most of the concerns are over emotional vulnerability.
BIDDLE: Absolutely right. I think a lot of the legal stuff hasn't been tested so much, but every day there are people who are regretting sharing that instant messenger password or giving someone the password to their laptop. And, you know, that's, like you said, an emotional consequence.
CONAN: We're talking about passwords. Our guests are Sam Biddle, who's a Gizmodo staff writer, and Woodrow Hartzog, who's an assistant professor of privacy law and online agreement at the Cumberland School of Law at Samford University in Birmingham, Alabama. Unsettled law, Woodrow Hartzog? Has this stuff been tested in court?
HARTZOG: No, not very well. We are still trying to figure out how to deal with passwords and usernames because we don't know exactly what that means. I mean, what does it mean to give someone a username and password? We've run into certain areas of the law, for example, if you lock your phone and you give it to a friend, does your friend have the right to consent to letting the police search your phone because they know your password? And is that something that you've given? And so we're still on a very unsettled stage of the law at this point.
CONAN: You're listening to TALK OF THE NATION, coming to you from NPR News. Here's an email from Amber(ph) in West Des Moines: My teenage brother shared his laptop computer and his password for iTunes with a friend. That friend ordered hundreds of dollars in music under my brother's name. The same friend also used my brother's laptop to look up pornography websites and put a keystroker program onto the laptop, which can be used to track all the keystrokes done on a computer and potentially track all the user's passwords. This situation turned out to be quite a learning process for my brother.
And I assume, Woodrow Hartzog, there could be some legal consequences there. What do you do about somebody who orders a whole bunch of stuff off iTunes?
HARTZOG: Well, that sounds like one of the worst case scenarios. The - you immediately try to dispute the charges. I think a lot depends on how you paid for the songs. And so if you - different payment systems have different rules with regard to whether you can challenge that payment or not. But the first thing you do is you say I didn't make these charges. Sadly, depending on how you paid for it, you may be stuck with some of those charges.
CONAN: Sam Biddle, is that something you've run into?
BIDDLE: I think that - on that scale is the exception. Again, like (unintelligible) said, that's such a worst case scenario that I don't think it's really, you know...
CONAN: That common, yeah.
BIDDLE: You know? Not at all, but, you know - yeah. Yeah. Absolutely. But it does show, you know, there is a friend you shouldn't have trusted in the first place. You know, not that you should be suspecting your friends and acquaintances, but, you know, you open people up to these really bad temptations, and you don't know what they're going to do with it.
CONAN: Let's go next to Andreas(ph), Andreas with us from Mooresville in North Carolina.
CONAN: Go ahead.
ANDREAS: Yeah. My - I learned some - well, didn't learn, but kind of figured out a long time ago since I - email practically began. But I keep actually two email accounts. I keep one that's personal, which means letters that I write to maybe friends and family, kind of like emotionally personal. It's my email. And I know everyone that that's something you never ask me for in any relationship I happen to be with.
And then I have a email account that I use for Amazon, and that I use for acquaintances and for business purposes, people send me pictures, and for buying movie tickets and doing all those things. And I share that one, you know, with my brothers, my sisters and my significant other at the time. It's very convenient to be able to call somebody and say, hey, can you get into my email real quick? Bring me that airplane ticket or give me that passage number, whatever might be required.
CONAN: So, theoretically, the account you do give out, you could end up facing some financial consequences. However, when there are emotional consequences, you shut everybody out.
(SOUNDBITE OF LAUGHTER)
CONAN: All right. Andreas, it's an interesting way to put it. That's drawing some boundaries there. This email from Benjamin in Piedmont, California: I gave my ex my password to Facebook and my email account. Then she started stalking me after we broke up, trying to figure out when I started cheating on her, which never occurred. I had no idea until a friend informed me about the situation.
And, Sam Biddle, that sounds like a - more the situation that I think probably most people encounter.
BIDDLE: Yeah. That's your textbook I-should-really-not-have-given-that-person-my-password incident. But, you know, even if it's not a matter of cheating, you can still find yourself trapped like that. You know, you might have, you know, let's say, something totally harmless, like you want to look up your high school boyfriend, and you're in a committed relationship or you're married. You know, that's something that would go through your head, and it's, I think, completely innocuous, but in someone else's eyes might trigger this whole paranoid jealousy fit, totally taken out of context. But, you know, I think most people should be entitled to that kind of, you know, curiosity, but it's private.
CONAN: Woodrow Hartzog, do you share your passwords with anyone?
HARTZOG: I do share - I have shared my passwords with my wife and only my wife, and so I understand the utility of that. But beyond that, I think that it's a really good idea to keep a lockdown on them. And I'd like to second what Sam said about information being taken out of context. We hear a lot of people say, well, I can let anyone read my email. I don't have anything that I would be embarrassed about.
But the real threat doesn't come with a secret coming through email but rather information that's being taken out of context. And so if you're not there to explain what this email meant, then perhaps it'd be misinterpreted and could lead to problems.
CONAN: Woodrow Hartzog, thanks very much for your time today. Appreciate it.
HARTZOG: My pleasure. Thank you for having me on.
CONAN: And, Sam Biddle, nice to have you with us.
BIDDLE: Pleasure. Thanks.
CONAN: Up next, Joe Paterno's death over the weekend ignited a fierce debate over the legacy of the Hall of Fame football coach. How should we remember Joe Paterno? Give us a call: 800-989-8255. Or you can send us an email: firstname.lastname@example.org. Stay with us. I'm Neal Conan. It's the TALK OF THE NATION from NPR News.