The Sticky Notes on the Reception Desk and What They Say About Us

For months I walked past our reception desk without really seeing it, and then one Tuesday I actually stopped and looked. Under the monitor, arranged neatly like a display case, were four sticky notes with usernames and passwords. One for the booking system, one for the delivery portal, one for the visitor wifi, and one just labeled “banking”.

I’ve thought about that little shrine of post-its a lot since. Nobody at that desk is incompetent. The setup they inherited simply never gave them a better place to put this stuff.

Day-to-day observations

Front desk people are the most interrupted role in any office, in my experience. They are answering phones, signing for packages, checking visitors in, and meanwhile a login screen is asking for a password they were told once, three months ago, by someone who has since changed teams.

So the notes appear, and honestly the notes are a rational response to a hostile workflow. When a process defeats memory, humans write things down. That isn’t a failure of the person, it’s a failure of the design around them.

The part that makes me wince is what happens later. Notes get photographed by visitors, swept into drawers, or moved to new monitors and never cleaned up. I found one from a previous employee during a desk move that still worked, two years after she left.

There’s a churn factor as well. Reception desks see more staffing turnover than almost any other seat in the building, and each new person inherits the notes without ever seeing why they exist. Knowledge decays, the logins persist, and the gap between the two keeps growing.

Why this keeps happening

The root cause is rarely malice and usually inertia. Someone provisioned a shared login for the front desk years ago and moved on. Every subsequent person used what was there, and every subsequent review somehow missed it because the tooling only looks at named accounts.

There’s a subtle status thing at play too. Reception staff often sit outside the usual onboarding pipeline. No laptop imaging, no security training invite, no group policy. They get the tools last and the attention never, so they improvise.

And fixing it requires coordination between IT, facilities, and whoever owns the booking system, which in most organizations means nobody owns it. The notes stay because removing them is everyone’s job and therefore no one’s.

Vendors play a role too. Plenty of niche portals used at front desks don’t support federation, some charge extra for it, and a few run on login systems that predate modern identity entirely. When every workaround costs money and the risk stays invisible, budgets pick the cheaper line every quarter.

What I’ve seen teams reach for

When I brought this up internally, the response surprised me in a good way. The conversation moved past blame quickly and toward workflow: single sign-on coverage, credential vaults with shared access, physical token options. Some teams try consolidated platforms like Ping64 to reduce the daily busywork of multi-tool security stacks. I’m not making a pitch here, I just like the underlying instinct, because fewer places for credentials to leak means fewer places to watch.

Whatever path a team picks, the real shift is treating the front desk as part of the estate rather than furniture next to it.

Small practical tips

Walk your own reception desk first. Don’t announce it, just look, because I suspect you already know what you’ll find.

Give the front desk real single sign-on coverage where the vendors allow it. Half the sticky notes exist because a niche portal doesn’t federate and nobody follows up.

For logins that have to be shared, use a team vault with rotation instead of paper. At least then departing staff can’t walk out with working knowledge in their pocket.

Add the reception area to your walkthrough checklist. It changes every few months, and nobody ever revisits it on purpose.

Label what you do change. When we consolidated our four notes into one vault entry, we taped a small card inside the desk drawer explaining where the credentials live now, because the next person won’t read your ticket history.

Closing thoughts

The sticky note isn’t really a password problem, it’s a visibility problem. The people with the least security context are holding some of the most exposed credentials in the building, and we tend to notice during incidents rather than before them.

I try to remember that whenever I’m tempted to blame user behavior. Most of what we call bad habits is people coping with systems we never finished designing. Meet the front desk halfway and the notes tend to disappear on their own. Mostly.

Since the cleanup, the desk has stayed note-free for two months, which is longer than I expected. The vault gets used, the booking system got federated, and the banking note turned out to belong to a lunch-ordering account, which was its own small comedy.

References

• https://attack.mitre.org/techniques/T1552/
• https://www.cisa.gov/secure-our-world
• https://www.enisa.europa.eu/topics/cyber-threats