73

I left my company on bad terms yesterday. I was ordered to leave immediately, take my documents, never come back to the company, and even to never meet my boss in life outside work.

The problem is that when I left the company, I forgot to log out of my Gmail, Stack Exchange network accounts, LinkedIn, work email and many other personal and professional accounts. The browsers remember almost all of my personal passwords.

Obviously, they will check my computer to get information about the project and it will be used by others (most probably by the manager of R&D department who is a very unethical person, interested in personal information about the others).

What is the best thing I can do about the problem?

  • 36
    Out-of-topic but might be important for your situation : There's no country tag so legislation may vary, but when your former boss told you to leave on the spot, did he write that your contract ended immediately ? As he seems to be quite unreasonable, he might deny having fired you and declare you AWOL to ask for a compensation in the future. – Berthim Sep 4 at 14:34
  • 2
    Could you add a country or state to your question? – Nyos Sep 4 at 22:03
  • 3
    I'm voting to close this question as off-topic because it's a technical question about protecting accounts more than a workplace one. – Dukeling Sep 5 at 8:00
  • 2
    @Dukeling don't agree, it is also about which accounts to use where, ethics of using private accounts at work etc. – Solar Mike Sep 5 at 8:10
  • 2
    Is there a works council and/or data protection officer at that company? – rackandboneman Sep 5 at 8:48
183

Go online and change all the passwords now for your personal accounts.

Obviously the OP no longer has access to the work machine, so this means either using a machine at home or even going to an internet cafe or equivalent to log in to all accounts as necessary and change passwords.

Work associated accounts like work email they will be able to, and have the right to, access anyway - even if you change the password they can use administrator rights.

  • 13
    @TheEvilMetal "This should remove cookies and log you out on other computers." -- You're saying that if I delete history and cookies in my home computer, that should result in my being logged out in my work computer? Deleting history and cookies shouldn't result in any sort of communication with the server or any other system, so nothing should change between the work computer and the servers. – JoL Sep 4 at 15:16
  • 2
    @Tom the manager clearly stated to the OP to never come back, so are you suggesting breaking in? Most seem to have understood that the idea is to log in from another machine which cannot be the work machine as the OP no longer has access... – Solar Mike Sep 4 at 15:32
  • 2
    @JoL In some cases, changing your password will log you out of all sessions. That's definitely not universal though. Google account/Gmail is an example of a service that does this, and I think possibly Amazon do it too. For services/websites that don't do that, changing your password at home/on another computer doesn't help, because it's still logged in on your work computer and they can freely access it. Not having the e-mail account linked with that account logged in at least prevents them from initiating a password reset to take over the account. – Anthony Grist Sep 4 at 15:57
  • 3
    @AnthonyGrist Changing passwords, sure. But that's different from deleting history and cookies in one computer and expecting that to affect other computers. – JoL Sep 4 at 16:20
  • 3
    Typically changing your password should invalidate sessions or provide a method to do so. This is however not always the case, not much you can do about it. Next time don’t use company machines for private accounts if you plan to fight the company :) – eckes Sep 5 at 7:51
135

Specifically Gmail you can log out remotely: https://support.google.com/mail/answer/8154

Sign out from another computer If you forgot to sign out of your email on another computer, you can remotely sign out of Gmail.

Open Gmail. In the bottom right corner, click Details and then Sign out all other web sessions. Tip: If you’re using a public or shared computer, sign out of your Google Account before leaving the computer. Learn more about signing in securely to Google.

And you might be able to see if anyone acceses it after you left: https://support.google.com/mail/answer/45938?hl=en

  • 4
    Facebook also has this feature – Blueriver Sep 4 at 19:01
  • 10
    The OP should change his passwords first. Most services log you out of all devices after changing your password. Remotely logging out on its own won't do much because the browser remembers the credentials. – Morgan Sep 5 at 2:45
  • 1
    Quoting the OP: "the browser remembers almost all my personal passwords". It's not a problem with login, but the passwords themselves – usr-local-ΕΨΗΕΛΩΝ Sep 5 at 7:37
  • The same for Stack Exchange (and log out can be for all Stack Exchange sites on all devices, using the option "Log out on all devices"). You may add this to your answer. Source: "Log out of all Stack Exchange sites with linked account simultaneously" – Peter Mortensen Sep 5 at 12:08
50

If you're using Chrome and you've logged in with your gmail, you might be able to log out of all other browsers through the browser settings. Go to your Google synched account from the top right, and then go to Account Security. From there you can log out of all other devices.

enter image description here

Then change your passwords immediately, or use a password manager addon to do it for you.

Other browsers have similar features but I'm not familiar with them.

  • 13
    Technically, Google's Security Checkup is offered on any browser. – Donald Sep 4 at 15:44
  • Quoting the OP: "the browser remembers almost all my personal passwords". It's not a problem with login, but the passwords themselves. This answers part of Gmail, but other passwords are still stored in that computer – usr-local-ΕΨΗΕΛΩΝ Sep 5 at 7:37
  • @usr-local-ΕΨΗΕΛΩΝ If the OP has enabled the sync feature, the passwords are associated with their account. Logging out manually as shown above should remove OP's personal account from the work machine, but of course it's not foolproof. – rath Sep 5 at 10:18
  • 2
    I personally use Firefox which stores the passwords on a local file, unencrypted. Sync feature is optional. Op did not cite which browser. This is why I upvote for all change-password answers – usr-local-ΕΨΗΕΛΩΝ Sep 5 at 11:57
  • 1
    @usr-local-ΕΨΗΕΛΩΝ If you specify a master password, Firefox will store the passwords encrypted. – Mark Rotteveel Sep 5 at 14:16
20

The browsers remember almost all of my personal passwords

in future, do not do that.

And only ever use private mode browsing at work, so as not to leave a history. Personally, I only ever visit Stack Overflow on my work PC, in private mode, and check my email at lunchtime on my 'phone. Doing otherwise might get you sacked at some places (and using LinkedIn at work is unlikely to ever give a good impression).

I Like @SolarMike's answer of changing all passwords & Geegory's comment about "log me out from other devices" - where offered.

Since you get on well with your boss, you could also call him and ask him to wipe all browser history & passwords, then reboot, to catch those sites which won't time out and where you can't remote log out.

And you probably should change all passwords, no matter how much you trust your boss. Just standard operational procedure (like never remembering them on a work PC in the first place).

  • 9
    The part with calling the boss would probably not work, since he explained the boss got angry and told him to never show up again. Even if the relationship was good before leaving I think the boss won't appreciate a request like this. – kirbby Sep 4 at 7:35
  • 10
    If browsing to a non-work-related site could "get you sacked" there are also usually draconian measures like no internet access, white-lists, or at least a dire warning that gives examples like "do not use gmail at work". Your advice is a bit extreme for most workplaces, I wish there were a survey of these practices so people could get a feel for what's normal-- it seems to vary a lot, but I think your practice is an outlier. – teego1967 Sep 4 at 10:45
  • 3
    +1 "in future, do not do that." indeed. very convenient for you... and anyone who has access to the computer to login to all of your websites now. – GibralterTop Sep 4 at 18:05
  • 2
    "call him [the boss] and ask him to wipe all browser history & passwords" - I wouldn't do that - that'd only alert him to the fact that the browser is still logged into some sites. Better to just start changing passwords, rendering the cached logins invalid. – Gertsen Sep 5 at 7:50
  • 1
    "And only ever use private mode browsing at work, so as not to leave a history" - this should come with a massive asterisk. They can still see all the websites you visit through network logging. And some companies install monitoring software on their computers. In-private browsing is useful, but it doesn't make insecure environments much more secure. – Dukeling Sep 5 at 12:34
6

You should certainly change your passwords, but on most corporate setups accessing your personal accounts would take deliberate action bordering on malice, and assistance from IT staff. malice I assume you were logged on to your own user account, as is normal practice. This means that your browser history/saved logins can only be accessed by someone logged on to the same account, which means a malicious ex-colleague can't simply walk up to the machine and impersonate you.

However IT can reset your password and may have a legitimate reason to do so to get access to stuff you were working on. This reset logon can then be used to access your browser records. So who would need access to your files? How much do you trust them? How quickly will IT respond to a request for access? This determines how worried you need to be.

  • 2
    Even though IT can access or allow access to a user's account, even that should be rare, as they also have administrative access to all files on the computer, and usually even the archive of company email accounts. For large organizations that I've worked for, permission from the legal department was needed for IT to log in as an employee. – aherocalledFrog Sep 4 at 20:04
  • 1
    @aherocalledFrog that should be true. I've dealt with a few tricky systems where getting meaningful data out was much easier logged in as the user who created it (dumb software putting metadata in the wrong place and needing it for export). Luckily I only had to deal with it with the relevant people's consent. – Chris H Sep 4 at 21:05
  • 1
    IT cannot reset the password on your personal email, if you get to it first. Of course they should reset the password on your work account, that's very different. – user90842 Sep 4 at 22:48
  • 1
    @GeorgeM of course they can't. I said they can reset the password so they can log in to your user account on their machine. Then they can access anything you've left logged in – Chris H Sep 5 at 7:01
  • @aherocalledFrog This is not as easy as it sounds. As soon as IT forces access to your user account any good OS will at least notify you in one way or another that this happend. AFAIK to get access to windows you have to reset the userpassword, which means you will see this as soon as you try to login again. No help for OP but generally it should not be possible to access user accounts without the user noticing. – Kami Kaze Sep 5 at 14:23
0

I forgot to log out of my gmail, stack exchange network accounts, LinkedIn, work email and many other personal and professional accounts

Generally speaking, you would not have been allowed access to the computer, which means you would not have been able to log out even if you had remembered.
Under such conditions, someone should have accompanied you back to your desk ad assisted you with removing your personal belongings.

and even to never meet my boss in life outside work.

Pretty sure that's not enforceable...

  • 4
    Ones old boss is just a person. They have status in a social context, that of employment, otherwise, just somebody you know. OP got fired, but seems like they are not the only one who was unprofessional. – chiggsy Sep 4 at 23:16
0

Logout all active session , By changing password.

-2

I realise this is no help to the OP now, but in case this is useful to anyone else having to leave behind a PC:

'Boot and Nuke' is a bootable image that secure wipes all harddrives on a PC:

https://dban.org/

Burn it to a USB or disc, boot, confirm, and it'll start secure wiping the drives. Realistically, you can leave the PC after a few minutes as (assuming a typical file system) the MTF will be overwritten almost immediately, which means it's already a forensics job to get useful data off the HD. Once it's completed one wipe, it'll require a specialist lab.

For SSD-based machines, DBAN may not be effective (but will almost certainly prevent casual efforts to retrieve data). https://partedmagic.com/secure-erase/ provides a secure erase with SSDs, or there's various SSD manufacturer tools which trigger an SSD secure erase command.

Note that in a work environment your files may have been backed up to the network and off-site, so you may not be able to delete them. Companies probably shouldn't be backing up personal data deliberately, but many companies don't do backups properly, or if you've not been given permission to use a machine for personal use they may not exclude personal folders. Obviously if you've got a laptop and they've taken a full image as a backup, then that will include personal data.

WARNING

OBVIOUSLY, only do this if you both have the right to wipe a machine, and you're confident that any company data is stored elsewhere. At any responsible company, it should be, because all company data should be mirrored on the network and backed up (or else it'd be lost in the event of a hard drive failure), but not all companies store data responsibly.

Policies on wiping machines and business practices on storing company data centrally vary between companies and industries.

  • Do you need access to the machine, which the OP did not have as they were walked out the door? Or is this software that wipes the machine if you don't enter a password every 20 minutes or so? – Solar Mike Sep 5 at 9:11
  • @SolarMike – yes, you need physical access, so as I said this is no use to the OP. I felt it was worth mentioning as others are likely to find this thread if searches around removing personal data from work PCs. – Dan W Sep 5 at 9:13
  • 2
    This is a very dangerous advice. You are directly attacking your company computer and erasing company records. which is an extraordinarily bad idea. Not to mention that this is not useful with SSDs. – WoJ Sep 5 at 11:39
  • 1
    @WoJ depends on your company. In my situation all non-personal data was kept on shared drives and source control. Devs had almost complete autonomy over their workstations (HW & SW) - by wiping them, we returned them the the condition we were given them. If you’re not in that situation, you probably shouldn’t be using the machine for anything personal. – Dan W Sep 5 at 11:58
  • 1
    @WoJ if wiping your machine erases company records, they’ve got a bigger problem as they’ve got no backups or disaster recovery. What would they do if your HD failed? Only the tiniest of companies should be without backups of company data. – Dan W Sep 5 at 12:08
-13

I have just retired and sold my manufacturing company. I have owned the company all but 2 years when I tried working for the man.

I am in the USA, in Tennessee. This is based on legal advice, updated over the years.

I can fire you for cause or no cause at all and with no warning at all. You work for the pleasure of the company.

I don't advise anyone to put personal data on a company-owned computer.

If you try to delete or wipe the company machine remotely, you have committed a computer crime, specifically theft or destruction of company property. The company has to right to examine all the data on the company computer and linked accounts, personal or otherwise, to make sure no trade secrets or other IP was being stored or transmitted using your "personal" accounts. I've worked with the district attorney and prosecuted two employees who tried remote (or local, in the case the employee is given a short notice of his pending discharge) wiping. both were indicted by the Grand Jury and both were convicted. One is still in prison.

You can and probably will be forced by the judge to reveal the new passwords on accounts you've changed remotely.

My advice is to back away from this, do nothing and learn your lesson.

My second advice is if you want to converse personal data at work (an ethically dubious practice), use a phone or tablet and do NOT use the company's WiFi. Use your cell company account. In many states including Tennessee, Any data you transmit over the company Wifi the company has the right to examine for IP violations.

many companies, including mine, will not allow personal computing devices in the work spaces where IP is developed or manipulated. I provide locker space where the employee can lock up his personal data device for the duration of the work shift. Even with those companies without specific controls, conduct of personal business is theft of your employee's time and THAT can be prosecuted.

Having an allegedly pending emergency is no excuse. Instruct the hospital or whatever to contact the switchboard which can contact you.

Each new-hire gets a spiral-book on personal IT business. It is stated at the beginning of the document in large letters that the first offense is an on-the-spot firing offense. The ex-employee is escorted to his car by security. A designated employee separates out personal items such as photographs and so on from company property and puts the personal property in boxes. The fired employee can make an appointment to pick up his personal property. He is escorted at all times he is on the company property.

This may seem harsh. I used to have as liberal rules on personal computing devices as most companies - until I lost a patent fight because an employee had been sending our IP to a competitor, after which he took a job with them. This was before the toughened IP protection laws. I had him prosecuted for theft of IP but I didn't get my patent.

My IP attorneys and I sat down and formulated this policy. Our policy manual suggests that if an employee has to conduct personal internet business, he go to his car and do it.

We bend over backward to keep our employees happy and satisfied with their work environment and turn-over is very low. But we are hard-asses about personal computing and that is explicitly laid out in the manual each employee gets. Turn-over is very low, almost non-existent.

Millennials tend to have the attitude that all that is necessary to do something is to want. I try to hire older, more experienced people but when HR sends me an occasional Millennial, I sit him down in my office and we have a lesson on rules compliance and ethical behavior. For most, this is a whole new experience, having neither their parents, their school and of course not their church which few attend have taught them the basic things my parents (The Greatest Generation), my school and my church taught me. One definition of moral behavior is doing the right thing when nobody's watching.

In summary, do nothing about this incident, suffer any adverse consequences from having personal data on your work computer and learn a lesson in basic morals.

John

  • 6
    It's rare that someone gets fired for purely for IT reasons unless it's a pretext for something more nebulous. Few employers working outside of TS/SCI have such a strict policy as yours. Occasional checking of gmail, stackoverflow, twitter, news, from a work computer is almost uniformly tolerated and fully ethical where allowed (in the USA, not sure about your country, TN). The most common restrictions are simple automatic blocking of URL's deemed "risky" though there are also ways to MITM https traffic content to screen for things that aren't supposed to be on the wire. – teego1967 Sep 4 at 21:18
  • 15
    So in summary, you're saying that (1) you age-discriminate and it's okay for you to do so, and (2) if your employees ever log in to a personal account on a work computer, it's a felony for them to ever change their password to that account again. Wow. Just wow. – Joseph Sible Sep 5 at 3:01
  • Perhaps move the statement "do nothing about this incident" to the very beginning so this answer does not appear to be off-topic? – Peter Mortensen Sep 5 at 12:23
  • 3
    I have to assume that this 'answer' is a fabrication designed to inflame people and generate reactions, since based on what you've described and your attitude I don't understand why anyone would work for someone like that. I've heard about bad working environments but that really takes the cake. I've flagged this as 'Not an answer' because... well.. it isn't. – Onyz Sep 5 at 12:28
  • @Onyz fair point - its not an answer to this question, unless timetravel is involved :) – Criggie Sep 5 at 13:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.