ARROGANT [removed]. TAKE YOUR PASSWORD REQUIREMENT AND STICK IT UP YOUR IVORY TOWER [removed]. [removed] YOU QUICKBOOKS. 

What in the world makes Quickbooks think that they know more about users security requirements than the professional users do?

Even the US Government has finally admitted that forcing people to change passwords do NOT improve security.

Let users decide if they want a password and if/when they want to change it.

Even major governments that move at glacial speeds recognize that forced password expiration does not improve security.

QuickBooks is becoming infuriating every time I switch between companies.

First, on a properly secured computer with an encrypted hard drive, QuickBooks password adds absolutely no additional security.

Second, users should decide if they need a password, not QuickBooks.

Third, if you're going to ram it down our throats, you could at least adopt modern password guidance.

https://pages.nist.gov/800-63-3/sp800-63b.html">https://pages.nist.gov/800-63-3/sp800-63b.html

https://jumpcloud.com/blog/nist-800-63-password-guidelines/

https://www.canada.ca/en/government/system/digital-government/password-guidance.html

https://www.ncsc.gov.uk/collection/passwords/updating-your-approach

And please don't even bother to mention PCI DSS.  PCI are dinosaurs and their standard has done virtually nothing to prevent data breaches involving payment cards. 

I suppose I'm piling on here, but QuickBooks needs to know this is a bunch of bull! I just spent an hour and a half chatting back and forth with them because I accidentally erased my password and somehow the security question/answers weren't exactly the right combo. I've been using this software for 15 years, who knows what I answered originally?!

After finally getting logged in and discovering somewhere along the lines I ended up with 2 different Intuit accounts (which is why the info I assumed was correct was not!) having occurred when I upgraded at some point.

The chat help ended with telling me to keep better notes on my password next time. As if I'm a flipping 5 year old! This on top of many other complaints not related to this, definitely time for me to kick QB to the curb!

I hope Intuit gets that (1) under many circumstances (such as a passworded computer with an encrypted hard drive) there is absolutely no need for a password, and (2) customers are getting annoyed enough that if this isn't fixed, we'll be looking at other products.

I have more than one company, and typing a password every time I change between companies is aggravating enough to have me looking at other software.

If you wish to remain in business, and especially in the small business sector, you might consider adopting a commitment to listening to your customers. 

With all due respect, I have been in cybersecurity for 25 years. I'm not interested Intuit articles on "privacy and security." I'm interested in fast, efficient account software that lets me get the entry made and get back to earning revenue.

You're fighting a hopeless call everyone.  No solution. (I held on to 2015 desktop for some clients because you don't have to use password protect in that version.  But I don't have to download for those clients. And you can't go backward. ) QB is deaf to your requests. They are protecting themselves. I started using QB when they first came out, before that I did general accounting and bookkeeping by hand.   I now use a QB online and desktop for a variety of clients. No matter how many requests you make, QB is now a monopoly and they are looking after themselves.  They will not respond if it is not in their interests.  I am pretty sure they got sued at some point because somebody breached a file and made away with money.   Then that user sued QB for not doing a better job of what they (the user) should have been protecting. The result is QB does not care if it's a inconvenient/time consuming for their customers (after all -- who are they going to go to for another program?).   Believe me I have had this experience in a variety of areas (try changing the admin on the desktop program when the previous admin has fled or is dead and you'll think not being able to bypass password is a breeze.)  Quickbooks, if  you're listening -- respond to your customers needs -- get them to sign a liability waiver as to the dangers of not having a password to protect and then let them use the program the way THEY want to use it.  You provide a great desktop program but the problems of administration in your organization are many (and this is one of the MINOR ones.).   I cannot recommend Quickbooks for these reasons to those ask me -- which is fairly often -- and anytime anyone does I tell them that they'll need to use QB because it's the only one of its kind really -- but they probably won't be happy.  A fact of life with a monopoly. Satisfied?

ANGELYN_T - your information about the password not being in effect unless the system has personal or banking data to protect cannot be true!  I use Quickbooks desktop - just upgraded to latest Premier Not For Profit and we don't have any of that information in our system and it still requires a password. We do not use any online services. As the ONLY employee for a small not for profit in which we have no personnel data in the system (no social insurance number), no bank account info (just the system default nomenclature) and no vendor tax ID - it is ridiculous to have to enter a password just to use the software and change that password every 90 days. Like others here have stated, password management is policy and should not be baked into the software to force purchasers/users of Quickbooks to work the way Quickbooks thinks we should! Use of password to open a company file should be an option not a restriction.

Hi @at_theBend,

I’m here to share some information about the password prompt when accessing company files using QuickBooks Desktop.

For compliance, QuickBooks requires a password regardless if you entered personal data or not.

Check out this article for more information on why QuickBooks Desktop requires passwords: Password security for QuickBooks Desktop.

That's it. Let me know if there's anything else you need about QuickBooks. I'm always here to offer more help. Take care.

ONCE AGAIN,

The issue is not the password per se, it is the Draconian Rules for changing the password, not being able to use the last four previous, etc.  These are not based on current security best practices.  And again, the final result of this is that we have to write the password down somewhere, defeating the whole purpose.

Hi @MaryAnn_E ,

Compliance with what law or regulation?

More specifically, what law would be breached if QuickBooks does not force users to use a password?

I can claim that visitors to my office must stand on their heads and sing God Save the Queen "for compliance" but unless there is a law that requires it, I'd just be making it up.

If QuickBooks Desktop is installed on a computer that requires a password to log in and has an encrypted drive, the only thing your password requirement does is irritate users.

I deleted Quickbooks and should sue for my money back. My business is not online and never will be. I do not want Intuit or any other company having access to my personal business period. There should be a class action against them because this feels very illegal to force someone to share their data online. 

Just purchased QB 2020 for $500+ and I will be asking for a refund and going back to QB 2012. Then I'll be finding another alternative in the coming year. Intuit won't fix anything in QB they don't want to as long as they are a monopoly. Also, they are pushing everyone to the subscription model...they actually want QB desktop to die. So I don't see any major resources going into the product.

This is like Excel scanning your workbook and finding a social security number and enforcing you to use a password on that workbook.

I can't wait for another reply from the Intuit/QuickBooks team telling me that "it is for your own good". Stop replying like people are stupid and, instead, actually listen to what people are saying.

Goodbye QuickBooks.

We don't store ANY of that info within Quickbooks.  After downloading an update (patch, etc.), we now have to use a password when for years we didn't.  We really like Quickbooks Manufacturing and use extensively, but just not for any personal info. of ours, or our customers.  We MUST be able to get rid of the password requirement.

We don't store ANY of that info within Quickbooks.  After downloading an update (patch, etc.), we now have to use a password when for years we didn't.  We really like Quickbooks Manufacturing and use extensively, but just not for any personal info. of ours, or our customers.  We HAVE TO be able to get rid of the password requirement.

Hello, @abn82d.

I understand that entering the password might take a little bit of your time. Password requirements are mandatory for users with sensitive information in QuickBooks and across all Intuit products, as this protects the data in the company file. Furthermore, it provides less worries with regards to data security.

Thank you for posting your concern, I will send this feedback to products engineers to continue improving our services. For you to be notified of the new update, you can visit our Intuit Blog.

Drop a comment below if you have additional question, have a great day.

"Password requirements are mandatory for users with sensitive information in QuickBooks and across all Intuit products"

I guess we need to start looking for a vendor that pays attention to customer requirements instead of just defending poor design decisions with fictional "compliance" arguments.

As a security professional, I find it offensive when software developers unnecessarily inconvenience customers and use "security" as an excuse.

I see this was over a year ago and still nothing has changed. This is some BULLS*&T!

The irony here is this thread has been going on since 2018 and in that time NIST has completely changed its guidelines on passwords.  They've removed the "90 day" recommendation along with many of the other recommendations that forced users to WRITE PASSWORDS DOWN ON PAPER which NIST found to be more vulnerable than passwords a user can remember.  Duh...  

The irony here is this thread started in 2018 and in that time NIST has changed its recommendations on passwords removing the "Change every x number of day" guideline.  Why?  BECAUSE PEOPLE WERE WRITING PASSWORDS DOWN ON PAPER!!!  NIST decided that was more vulnerable than just making it easy for users to remember their own passwords.   Duh  

Password and security options should be just that, optional. This is a COMPANY POLICY decision. Your mandatory security takes that decision away from the user. STOP telling us how to run our businesses. Your community experts are completely tone deaf.

I feel the same as the majority here.

So I have a password, and though I used to find it only mildly annoying, last weekend I spent about 10 hours trying to access my QB company files. First every company file was gave an unable to access message. I used the tools and tried mightily to fix the files (I don't actually believe there is anything wrong with my QB files, as every time I used the tool feature, it said as much). Then partway through the day, each time I entered a password, I was told that it was wrong. So I went through changing the password, entering my license information, etc. and as soon as it said my password had been changed, it asked me for my password again. (I kept extremely detailed notes about each iteration of my password). As soon as I entered the new password, lo and behold, it was wrong. So I went through changing it again, entering my license information, etc.  As soon as it said it was changed, it asked me to log in and then when I entered the new password, it said it was wrong. I went through this process at least four times until finally the system informed me that I was locked out. Now who is the password helping? And what do I do about this? And no I don't want a password. My desktop computer has a wickedly secure password, so I don't need a pw on my QB Pro Desktop 2019 program.

I know it can be frustrating when you're being asked repeatedly to change your password, mindi8.

We don't intend to decide for you when it comes to your account preferences. But the mandatory access setting was set to make sure that no one else can access your file but only you. 

Password security is an extra measure to keep your account protected and secured. Please check this out: Password security for QuickBooks Desktop. 

I'll take note of your feedback regarding the password security with the management team so they'd know your sentiments.

If you have any other concerns about password security in QuickBooks Desktop, I'm always here to answer them for you.