There’s a computer in the church office. It sits on the desk near the window, and it has been there long enough that nobody remembers who bought it.<\/p>\n\n\n\n
Everyone uses it. The office administrator, obviously. The treasurer on Thursday mornings. The youth director when the church laptop is somewhere else. Two volunteers who take turns doing the bulletin. The pastor, when he needs to print something.<\/p>\n\n\n\n
They all sign in the same way, because there is only one way to sign in. The account is called Office<\/em>, and the password is on an index card under the keyboard:<\/p>\n\n\n\n Office \/ FirstChurch2019!<\/em> (giving site + email — same one)<\/em><\/p><\/blockquote>\n\n\n\n Nobody did anything wrong here. This is what happens when five people share one machine, none of them work full time, and the alternative — remembering who has which password — sounds like more administration than anybody has room for. The card under the keyboard is a reasonable solution to a real problem.<\/p>\n\n\n\n It’s also the single point where a small organization’s whole digital life is exposed, and the fix costs nothing but an afternoon.<\/p>\n\n\n\n Four specific things, and it’s worth being concrete about each, because “shared accounts are bad practice” is abstract enough to ignore.<\/p>\n\n\n\n You can never tell who did what.<\/strong> A file is deleted, a giving record is edited, a check register doesn’t balance. The computer’s own records say Office<\/em> did it, which is true and useless. There’s no way to reconstruct a mistake, no way to clear someone who’s been quietly suspected, and no way to answer an auditor or an insurer who asks a reasonable question. The absence of an answer is worse for the innocent than the guilty — in a small church, the not-knowing lands on everyone.<\/p>\n\n\n\n One bad moment exposes everything anyone has ever opened.<\/strong> If a volunteer downloads the wrong attachment, whatever runs next is running as Office<\/em>, and Office<\/em> can reach every file, every saved password, and every signed-in website that anyone has ever used on that machine. There are no walls inside a shared account, because a shared account is one room.<\/p>\n\n\n\n A person who left in 2021 still has the keys.<\/strong> The volunteer who did the bulletin for two years and moved to another state knows the password. So does her husband, probably, and anyone she wrote it down for. Nobody has changed it, because changing it means telling five people, and one of them is always on vacation. Every departure since the card was written is still a person who can get in.<\/p>\n\n\n\n And the browser hands over the money.<\/strong> The biggest one, the least understood, and it needs its own section.<\/p>\n\n\n\n When you use Chrome, Edge, Safari, or Firefox, everything about “you” — your saved passwords, your bookmarks, your history, and the small files that keep you logged in — lives in something called a browser profile<\/strong>. It’s the browser’s version of a user account. On a shared computer with one login, there is one profile, and everybody is inside it.<\/p>\n\n\n\n Two things in that profile matter enormously.<\/p>\n\n\n\n Saved passwords.<\/strong> Every time someone clicked Save password<\/em> — for the giving platform, the bank, the church management system, the email account, the domain registrar — the browser filed it away. Anyone sitting at that desk can open the browser’s password screen and read them in plain text, or simply visit the site and let it fill itself in.<\/p>\n\n\n\n Session cookies.<\/strong> When you sign in to a website, the site gives your browser a small token that says this browser is already logged in, don’t ask again<\/em>. That’s why you don’t retype your bank password every morning. It’s also why a machine that nobody is currently sitting at is still, from the website’s point of view, signed in.<\/p>\n\n\n\n Put those together and the practical situation is this: anyone who can get to that keyboard, or anything that runs on that computer, can reach your giving platform and your bank without ever knowing a password.<\/strong> Not by guessing. By clicking the bookmark.<\/p>\n\n\n\n That is the actual risk on a shared office computer. Not that someone will crack a code — that no code is being asked for.<\/p>\n\n\n\n You do not need a new computer, new software, or a budget line. Both Windows and macOS have supported multiple user accounts on one machine for decades, and it’s free.<\/p>\n\n\n\n Give each regular person their own account.<\/strong> Not a personal computer — a personal account<\/em> on the shared computer. Their own desktop, their own files, and critically, their own browser profile with their own saved passwords. When the treasurer signs out, her session ends. When the bulletin volunteer signs in, she sees her own world and not the church’s bank account.<\/p>\n\n\n\n Four or five accounts is normal for a church office, plus a Guest<\/em> account for the occasional person who just needs to print, with nothing saved in it.<\/p>\n\n\n\n Make the everyday accounts non-administrator.<\/strong> An administrator<\/strong> account is one that’s allowed to install software and change the machine’s settings. The everyday accounts don’t need that power, and taking it away means that when something malicious tries to install itself, it hits a wall and asks for a password that the person sitting there doesn’t have.<\/p>\n\n\n\n Create one administrator account with a strong unique password, write it down, and put it where the pastor and the treasurer can both reach it — a sealed envelope in the safe is genuinely fine. Don’t use it for daily work; it exists for installing things and fixing things.<\/p>\n\n\n\n That single change, more than any product you could buy, is what stops an ordinary bad click from becoming a bad week.<\/p>\n\n\n\n With the accounts in place, four things remain. None takes long.<\/p>\n\n\n\n Turn on the automatic screen lock.<\/strong> Both operating systems will lock the screen after a set idle period and ask for the password to come back. Ten or fifteen minutes is right for a church office. This is the control that handles the real-world scenario — not a break-in, but the office being empty for twenty minutes during a funeral while contractors and members of the congregation walk past an unlocked desk.<\/p>\n\n\n\n Turn on full-disk encryption.<\/strong> Encryption<\/strong> scrambles everything stored on the machine so that it’s unreadable without the password. On Windows this is BitLocker<\/strong>; on Windows Home the same protection appears as device encryption<\/em>, which switches BitLocker on for you. On Mac it’s FileVault<\/strong>. All are built in and free.<\/p>\n\n\n\n Without it, a stolen computer is an open filing cabinet — someone can pull the drive out and read every file on it without knowing any of your passwords. With it, a stolen computer is a brick. Newer Macs encrypt storage automatically, but FileVault is what ties decryption to somebody actually knowing the login password, which is the part that matters. On Windows, look under privacy and security settings for device encryption or BitLocker and confirm it’s on — on a machine signed in with a local account rather than a Microsoft account, it often isn’t.<\/p>\n\n\n\n One warning that Apple states bluntly and that applies to both systems: if you turn on encryption and then lose both the password and the recovery key, the files are gone permanently. Store the recovery key with the administrator password, in the safe.<\/p>\n\n\n\n Keep the operating system and browser updated.<\/strong> Turn on automatic updates and let them run. And check what the machine is actually running. Microsoft ended support for Windows 10 on October 14, 2025, which means no more security fixes; consumers can enroll in Extended Security Updates, which deliver critical and important security fixes — nothing else, and no technical support — through October 12, 2027, and after that the machine is genuinely unsafe for handling donations. If your office computer is old enough that its operating system has been retired, that’s the budget conversation to have this year.<\/p>\n\n\n\n Move the passwords out of the browser.<\/strong> Open the browser’s saved-password list, work through it, and move each one into a password manager<\/strong> — a separate encrypted app whose whole job is storing passwords, with a shared vault the office can use for the accounts several people genuinely need. Then delete them from the browser and turn off the offer to save.<\/p>\n\n\n\n While you’re in there, sign out of the giving platform, the bank, and the church management system, and set them to require a sign-in each time. It’s ninety seconds of friction a day. It’s the ninety seconds that stands between a shared keyboard and your operating account.<\/p>\n\n\n\n “Switching users is slow.”<\/strong> It is, a little. But nobody has to shut down — both systems let one person stay signed in while another switches over, and coming back takes a password. What makes it painless is doing the setup once: get each person signed in, let them set their own preferences, and the daily friction is a password.<\/p>\n\n\n\n “The volunteers will grumble.”<\/strong> Some will. The framing that works is not security, it’s fairness: your account is yours, so nothing that happens on somebody else’s shift lands on you.<\/em> People understand being protected from blame far faster than they understand threat models.<\/p>\n\n\n\n “We’ll forget the passwords.”<\/strong> Yes, if you ask people to invent complicated ones. Don’t. Use a memorable passphrase of three or four unrelated words for the login itself, and let the password manager handle everything else. The administrator password in the safe turns a forgotten password into a five-minute fix.<\/p>\n\n\n\n “It’s just the bulletin computer.”<\/strong> It’s the computer with the browser that’s signed in to your giving platform. It stopped being the bulletin computer some time ago.<\/p>\n\n\n\n Eventually the old tower gets replaced, and someone offers to take it home, or it goes to a member starting a small business, or a recycler collects it.<\/p>\n\n\n\n Deleting files does not remove them.<\/strong> Deleting marks the space as available for reuse; the contents sit there until something happens to overwrite them, and free recovery tools will pull them back. The FTC’s guidance for businesses is direct about this: use software designed to securely erase data, because ordinary delete commands aren’t sufficient. NIST’s federal guidance on media sanitization makes the same distinction — there is a difference between removing the pointer to data and removing the data.<\/p>\n\n\n\n The practical version for a church office:<\/p>\n\n\n\n If the machine was encrypted the whole time, you’re mostly there already.<\/strong> Destroying the encryption key makes the contents unreadable — one more reason to turn encryption on early rather than at the end.<\/p>\n\n\n\n Use the built-in full reset.<\/strong> Windows offers a reset that removes everything, with an option to clean the drive rather than just delete files — choose that one, and expect hours. Modern Macs offer an erase-all-content-and-settings option that wipes the machine back to factory state. Sign out of the Microsoft or Apple account first, so your account isn’t tied to a machine you no longer control.<\/p>\n\n\n\n If the drive held donor or member records and you can’t verify the wipe, destroy the drive.<\/strong> Remove it and have it physically destroyed. A drive is worth less than the trust of the people whose data was on it.<\/p>\n\n\n\n Then clean up what the machine could reach.<\/strong> Change the passwords that lived in that browser, and sign out of active sessions on the giving platform and email. The computer leaving the building doesn’t sign it out of anything.<\/p>\n\n\n\n Sit down at the office computer for forty-five minutes with whoever knows it best. Open the browser’s saved-password list and read it out loud — the giving platform, the bank, the email account, whatever’s there. That list is the argument; you won’t need to make another one.<\/p>\n\n\n\n Then do two things: turn on the automatic screen lock, and confirm full-disk encryption is on (BitLocker or device encryption on Windows, FileVault on Mac), writing the recovery key into the safe. Separate user accounts can be next week’s job, and they’ll go faster once the list has been seen.<\/p>\n\n\n\n The office computer is one item on a longer list. MissionDefend’s free assessment asks plain-English questions about how your organization handles email, donations, member data, and accounts — including shared machines and saved passwords — and returns a baseline score with a ranked list of what to fix first.<\/p>\n\n\n\nWhat “one login” actually costs you<\/h2>\n\n\n\n
A signed-in browser is a signed-in everything<\/h2>\n\n\n\n
Separate accounts on the same machine, at no cost<\/h2>\n\n\n\n
Three settings and one habit<\/h2>\n\n\n\n
The objections are fair, and here’s the answer<\/h2>\n\n\n\n
When the machine finally goes<\/h2>\n\n\n\n
What to do this week<\/h2>\n\n\n\n