I have given my notice at a small software development firm. I still have a couple of weeks so I am transferring my knowledge to a colleague. A couple of days ago, I have realized that I am not allowed to wipe the hard drives of the two computers I have been using. I have also found out that some of my passwords were stored as plaintext on some local servers. What would be the best course of action for me in order to keep my privacy?
Refrain from keeping personal data or using personal online accounts on a work computer
What would be the best course of action for me in order to keep my privacy?
Best course of action would be to remove all passwords and sensitive information from the computers/servers. Use secure delete command in the OS or use a 3rd party tool to render the deleted data unrecoverable. You don't need to wipe hard drives to do so.
You don't want to give any of your team members a misleading impression by stating that you need to wipe the hard drive. They may be afraid to lose any sensitive data, settings, app licenses etc. that may not be backed up or would require time taking configuration. State that you need to remove some personal data and not wipe the hard drive.
If you are not allowed access to computers or allowed to change anything, and the passwords correspond to your personal account, simply change them. Revoke any personal SSH keys deployed.
I have faced similar issues in past, and general advise I follow is to refrain from using any personal accounts or saving any personal data on work computers. I request IT to setup a company account for anything that I need.
Additionally, you may never know how the office network is configured. Your personal data from your computer/laptop/tables/smartphones may still be read/sniffed/logged if you access office network/Wi-Fi using them.
Always keep work and office data and equipments segregated and refrain from accessing work network/Wi-Fi from personal devices.
You should let your IT team handle your work computers - consider asking a colleague there if they can do a fresh install to overwrite the existing data. If your company doesn't have an IT team or a vendor, talk with the individual responsible for managing the computers. Administrating equipment is usually not part of a developer's role, so you should ask those in the proper role to help you or defer to their judgement.
Change your personal passwords elsewhere, and any passwords that are the same as those stored. While you don't have control over your data on company equipment, you can take steps to keep yourself secure elsewhere. Change your GitHub/bank/etc. passwords and enable 2FA. You should be doing this regularly anyway.
In the future consider a password manager to store your personal information on a work computer in a way that is secure but also easily accessible to you. Of course, check with your firm's IT team to ensure the extra install is allowed.
Only passwords? Not PII like DOB, SSN (or whatever personal id you use in your country)? If so, I would simply change the passwords on the sites I logged into. Gmail, banks, etc usually have 2 factor authentications. With gmail, I know you can revoke access to devices like your workstation and so forth. You can easily change the passwords and turn on 2 factor authentication. Then it wouldn't really matter if your password is visible on the work machines. As it wouldn't work and if it did, they'd have to enter the 2nd code to fully log in.