1

I'm a senior developer (relative to this company, by years, and knowledge of how the company runs and knowledge of systems, passwords, networks etc.) in a small business of 8 people including the Managing Director/our boss. I've been at the company for almost 5 years now and over the last year and a half it's been very much a plateau for me and I'm not learning anything or improving, and the work being brought in doesn't interest me and it seems that no new technologies are being used or implemented, and suggestions brought up to do so are generally backed down.

I do have a career change in mind, which is a drastic change to what I currently do, which interests me a great load more now than when I started my development career at the age of 17.

Being that I am a senior developer at this company, I know quite a chunk of information imperative to the operation of the company. Whilst 90% of what I know is written down in the documentation, the other 10% is information that I don't know I have until the discussion of a topic comes up and my brain triggers an "oh, this is X,Y and Z. Do A, B and C", the concern I have is the number of passwords I know off by heart or by muscle memory.

Should I provide my boss with a list of all the passwords I know, as a courtesy to them that way they don't have to worry about figuring out what needs/should be changed or not? Or could this be perceived as "He's telling me knows all these passwords, and that I should change them, he's going to attempt to do something after he leaves."?

EDIT: I'm not saying I know passwords they don't or aren't logged, I'm saying that I know a lot of them off by heart and should I let them know which passwords so they don't have to go looking through the password manager in use

Improve this question
10
14

When you leave in this sort of situation you should prepare a hand over document for your successor, this would include any passwords or procedures that only you know and are integral to the position and will be their primary reference while they get up to speed.

You are the expert in your position, not the boss, everything should be centrally and logically concentrated into this document. Not given piecemeal to your boss but as a whole.

I still see comprehensive hand over documents I made over a decade ago still in use and updated by chaps who are 3rd generation or more successors of me in those roles.

Improve this answer
5
  • 2
    I have to disagree slightly. Passwords should never be handed over. They should be reset for whoever takes over that position. In the event the company is not ready to do that, the boss should set the new password then change it again once the person who will take over is present. – SaggingRufus Oct 10 '18 at 13:21
  • @SaggingRufus that depends on whether it are personal passwords, those should be invalidated when you leave, or tool user passwords, those can be handed over. – Frank Hopkins Oct 10 '18 at 22:46
  • @SaggingRufus yes, lots of different ways of handling it, many of which require no input from an employee, none of them the OP's problem unless it's their role, in which case he/she wouldn't be asking. I make a handover document with the existing passwords, I expect them to be changed and the document updated by my successor, but it's not my problem whether they do or not. – Kilisi♦ Oct 11 '18 at 4:59
  • 1
    @SaggingRufus: Sure in a perfect world with a credential management systems. In 8 people companies they don't have these. You need to write down all the passwords you use on a regular basis. It is the responsibility of the person taking over the role to reset them as appropriate. I would definitely not reset them before leaving; without a credential management system I would put money on some systems depending on the password being something specific for some automated tool hacked together 5 years ago that nobody remembers is just quietly doing its thing (that will spontaneously distrust). – Martin York Oct 11 '18 at 7:03
  • Before leaving add a task to the backlog "Add credential management system so people don't need to remember passwords anymore". – Martin York Oct 11 '18 at 7:07
2

You're asking two questions:

  • Should I give my company the passwords I have and they don't
  • Should I do this now

The answer to the second one is you don't have to, just write them down somewhere (if you go this route - see the rest of this answer) and hand them in right after your notice.

I'm making the following assumptions about the passwords:

  1. The accounts are generic (ie. admin) and in no way tied to your personal account
  2. You are the only one with access to that service or account
  3. They are not shared with any other accounts, yours or not, personal or not

As a technical guy I cringe every time words formulate a sentence in the way you have because passwords are generally personal. However I don't think you're doing anything violating that principle so I will continue without screeching "that's inshechure" at the top of my lungs.

But I will still follow the general advice in these situations, just for the sake of principle. The general pattern is to give access to the resource and the password is one of many ways to do that.

External services usually let you add other Users or Points of Contact to the account. Add your manager or a colleague now, because it makes sense to increase the bus factor regardless of your looking to make a move.

Internal services can usually make do without you, your own admins will be able to reset access whenever they need it. It would still be good to make a list of those accounts in your hand-over documentation.

Everything else, weird artifacts like local KDBX files, etc, can be divulged if you change the password first to really make sure it's not shared. If these artifacts are accessible from a public network, and your own admins cannot control access, I would definitely make a bold point on that, perhaps in a separate email, to make them change that password as soon as possible.

Improve this answer
2

Should I provide my boss with a list of all the passwords I know, as a courtesy to them that way they don't have to worry about figuring out what needs/should be changed or not?

I say you stick to providing the info that your boss requires from you in the process of leaving (during your Notice period most likely).

Companies have their own protocols and procedures when someone leaves, including revocation of credentials, handling equipment, etc. You should stick to what they ask you to hand, which will most likely include a list of the passwords of your users.

Depending on the company, they should also change/update their passwords and credentials the moment a senior employee leaves, and not just depend on them giving them all they credentials they recall (as it leaves spaces for human error as well as chance of withholding information).

Improve this answer
1

I'm saying that I know a lot of them off by heart and should I let them know which passwords so they don't have to go looking through the password manager in use

The password manager exists for a reason - it is presumably put in place specifically because it's the standard level of security that the company expects.

Going around the password manager is therefore a no-go as it actively violates the password manager policy.
Whether it's you writing something down on paper as a personal reminder, or you writing it down for others to read (with good intentions), doesn't really matter here. You're violating the policy either way.

You should not circumvent the password manager and thus not write down/give out passwords to anyone. It's the password manager's responsibility to manage people's access to certain passwords.

Should I provide my boss with a list of all the passwords I know, as a courtesy to them that way they don't have to worry about figuring out what needs/should be changed or not?

There's no need to share the password itself, as mentioned before.

However, if you really want to avoid being blamed for future intrusions, you could suggest that the passwords are refreshed after your absence. I don't think this is a particularly necessary step, but if you really want to ensure this, simply asking to refresh is the best way.

You don't need to actually give the current passwords for them to do that. Simply stating that you know some important passwords is enough of a heads up.

Or could this be perceived as "He's telling me knows all these passwords, and that I should change them, he's going to attempt to do something after he leaves."?

Even if that idea were to enter their minds (which I highly doubt unless you've given them reason to suspect this), by giving the passwords and confirming your knowledge you are effectively proving that you do not have malevolent intentions (because you'd be ruining your own plans by alerting them).

"He knows the passwords and tells us he knows them, he must therefore be planning something sneaky" is not a logical conclusion to make.

Improve this answer
-1

You should go to your boss and say that you know a lot of passwords, and if you were hit by a bus, it could cause problems for the business. Therefore, you suggest it is time to buy a password manager program, where you could put in all the passwords, and others could have access to appropriate passwords.

My current company uses something called PasswordState, which allows me access to a small subset of the passwords that are stored in it. That might be overkill for a small company, and there might be other software packages that are better for your company. You can offer to do some research on options as well. And then, buy a password manager that the company will use. The boss will of course also have access, and if you leave, you're leaving things in good shape.

What this will look like is you are looking out for the interests of the company, not that you are looking to leave or cause damage if you were to leave.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .