I wonder if that process was passed by legal first. Not only does it make private (in most user's minds) information public, it also makes it legally discoverable!

Yes, it was passed by legal and everyone else. The first warning was automated and the password wasn't revealed. It was only on the second pass once you had ample warning.

But to be fair, I wouldn't do that today. I would just shut off the account on the second pass.

You shouldn't be using deeply personal stuff like this for work passwords then.

It's very legitimate for a company to want to protect themselves from a massively damaging and costly security/privacy incident by policing against the use of weak passwords.

Just to be clear, I agree, and I think what the person I'm replying to did is totally kosher. But I just think the fact that my password is private should not just be within technical limitations. If you find my password is "hurtmedaddy" I have a reasonable expectation to privacy about that beyond what SHA can and can't protect me from, and I would hope it's not showing up in some weekly report to be shared with IT. A hacker might find it anyway, but certainly my boss certainly shouldn't have to.

edit: And back to technical concerns - someone knowing my password leaves a hard-to-audit window in which I am even less secure. Force-resetting the password in automation instead of revealing it would be better. Sharing it more widely before the problem is fixed increases the risk.

I personally would not have any expectation that my work passwords are private. I would expect, say, Google to keep my password private, and have internal controls around not letting people see my password, or leak it to the outside. But I'd have no expectation that my boss or IT department didn't have the ability to find out what my password was if they wanted. For strength of security, I really hope they're hashing passwords, but it's well within their rights to try to crack that hash, or log my password as I send it to a webserver the company controls if they want/need to for any reason.

As an imperfect analogy, let's say I write something in a plaintext document, a big rant about how I'm pissed off at one of the executives, and in that rant I make a (not serious, but certainly worrisome) threat against the exec. I foolishly decide to store this document in my company-provided storage on their servers. (Or let's say I stick it in Google Docs in the company's GSuite account.)

Should I have a reasonable expectation of privacy there? I'd say no. I get that some might have the feeling that passwords are different because their entire function is to be private. From a security perspective, yes, I agree. But form a "what you do on company property/resources is visible to the company if they want it to be" perspective, I don't.

That's not unreasonable, but as you said the point is to be private - it's definitely not what people expect. If they were going to try crack my passwords and look at them when they're cracked, I'd want a memo, to say the least.

I am of two minds about, if it helps security, it sounds somewhat reasonable,but I used questionable passwords in the past partly because they were easy to memorize along the lines of missslippyfist and some numbers/chars. I was forced to stop once company I used to work for started filtering for curses.

And running to HR over perceived creepyness sounds like a dick move.

Given the frequency of online password db breaches, this seems like a really bad idea...

Agreed. I would hope that the first email was automated and nobody actually looked at the results of cracking the passwords. In the second week, you arguably had less expectation of privacy.

Correct, the first warning was automated and the password was not revealed.