10

I have given my notice at a small software development firm. I still have a couple of weeks so I am transferring my knowledge to a colleague. A couple of days ago, I have realized that I am not allowed to wipe the hard drives of the two computers I have been using. I have also found out that some of my passwords were stored as plaintext on some local servers. What would be the best course of action for me in order to keep my privacy?

  • 16
    Change your password? – ChrisR Jul 17 at 8:01
  • 23
    This is for anyone else who comes across this question. Do not put personal information on your work computer in the first place. I've come back from a long weekend to find my boss had sold my computer to a customer. If you need to do something personal, use your phone and use cellular data. – user10399 Jul 17 at 8:15
  • 4
    I am also genuinely interested in why this question deserves a downvote. – NMilev Jul 17 at 8:46
  • 2
    Work is work. Personal is personal. Never the twain shall meet. – joeqwerty Jul 17 at 11:46
  • 1
    @Dukeling I am asking what measures should I take to delete the personal data from the workplace computers. I believe those measures can be both technical and people-related, which is why I have posted it here. Also, people have given advice about what should be even stored on the workplace computers to begin with. Also, yes, just the passwords concern me since I used one that is almost the same as some of my personal passwords. I have never used my work computers for personal tasks except in some light manner (for example, looking for a phone in a web store). – NMilev Jul 17 at 19:18
12

Refrain from keeping personal data or using personal online accounts on a work computer

What would be the best course of action for me in order to keep my privacy?

Best course of action would be to remove all passwords and sensitive information from the computers/servers. Use secure delete command in the OS or use a 3rd party tool to render the deleted data unrecoverable. You don't need to wipe hard drives to do so.

You don't want to give any of your team members a misleading impression by stating that you need to wipe the hard drive. They may be afraid to lose any sensitive data, settings, app licenses etc. that may not be backed up or would require time taking configuration. State that you need to remove some personal data and not wipe the hard drive.

If you are not allowed access to computers or allowed to change anything, and the passwords correspond to your personal account, simply change them. Revoke any personal SSH keys deployed.

I have faced similar issues in past, and general advise I follow is to refrain from using any personal accounts or saving any personal data on work computers. I request IT to setup a company account for anything that I need.


Additionally, you may never know how the office network is configured. Your personal data from your computer/laptop/tables/smartphones may still be read/sniffed/logged if you access office network/Wi-Fi using them.

Always keep work and office data and equipments segregated and refrain from accessing work network/Wi-Fi from personal devices.

  • 2
    I am not allowed to reinstall the os since it will delete some setting that they might find usable later on. It seems to me that the best thing is to try and delete as much as I can while changing all the personal passwords. And not to make this mistake again – NMilev Jul 17 at 8:16
  • 5
    I see such advice a lot, but there's a fairly large "grey area" here which few people seem to acknowledge. In most workplaces there exists a level of trust between employer and employee which makes accessing things like gmail, banking, social-media and news on a work machine a reasonable thing in moderation (with the exception of "secure facilities"). The vast majority of these things with passwords are web-applications where you can easily change passwords, use 2FA, or a password manager, and wipe browser history/cache to prevent casual poking around. Why aren't these actions "enough"? – teego1967 Jul 17 at 9:41
  • 2
    @Jay Companies may tolerate some personal use for your company PC, but that doesn't mean you should be using it. You are at the mercy of the IT department wiping the PC when you leave. A smart company does that anyway, but you cannot count on it. If you are worried enough about people stealing passwords/data from your work PC, don't use it for personal business. – pboss3010 Jul 17 at 12:53
  • 2
    @dwizum, I have the exact opposite experience! It seems that there’s a wide variation in what’s considered acceptable/normal behavior with respect to usage of work computers. – teego1967 Jul 17 at 14:51
  • 1
    @dwizum: In $MANY years of work history, I've never worked in an environment where it wasn't considered OK to check personal email on company hardware. At my most recent job, for example, the workstation on my desk was owned by the company, but nobody other than me had login access to it. (When I left the job, I deleted non-company related information and shut it down. I was told that the hard drive would be wiped later.) I understand my experience is not universal and might not be typical, especially for people other than software developers. – Keith Thompson Jul 17 at 21:59
7

You should let your IT team handle your work computers - consider asking a colleague there if they can do a fresh install to overwrite the existing data. If your company doesn't have an IT team or a vendor, talk with the individual responsible for managing the computers. Administrating equipment is usually not part of a developer's role, so you should ask those in the proper role to help you or defer to their judgement.

Change your personal passwords elsewhere, and any passwords that are the same as those stored. While you don't have control over your data on company equipment, you can take steps to keep yourself secure elsewhere. Change your GitHub/bank/etc. passwords and enable 2FA. You should be doing this regularly anyway.

In the future consider a password manager to store your personal information on a work computer in a way that is secure but also easily accessible to you. Of course, check with your firm's IT team to ensure the extra install is allowed.

3

IMHO, change all your passwords that may have been stored there as soon as possible.

And for the next time, do not keep any personal information on the work computer as you can be denied access to it at any time

1

Only passwords? Not PII like DOB, SSN (or whatever personal id you use in your country)? If so, I would simply change the passwords on the sites I logged into. Gmail, banks, etc usually have 2 factor authentications. With gmail, I know you can revoke access to devices like your workstation and so forth. You can easily change the passwords and turn on 2 factor authentication. Then it wouldn't really matter if your password is visible on the work machines. As it wouldn't work and if it did, they'd have to enter the 2nd code to fully log in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.