No vendor should be allowed to pick his or her own password for any account, even temporarily. Some vendors have been known to use the same or similar passwords across multiple customer systems. For example, one network security company set up privileged accounts on all their customers' systems with the same password, and, to add insult to injury, with outside Telnet access enabled.