8

My manager told all of us today (~10 person team) to make a paper list of our work email passwords for him. Someone else told him he can get it from IT, and he said IT wouldn't let him have them. How should I/we proceed with this?

  • 3
    What's the structure of his company? Do you have a security officer or any other authority who would oversee or audit security-related issues? Can we assume the email accounts are related to individuals (i.e. hmmm@employer.com) or are they generic (i.e. CustomerService@employer.com)? – dwizum Sep 13 '19 at 14:05
  • 2
    Several things needed for this - country? What emails? Is it work or personal (if personal then don't!). Have you asked your manager why he needs them especially if IT say no? Have you explained the security issues around paper copies? – MattR Sep 13 '19 at 14:06
  • 2
    @rath 100% agreed. Demanding a written request isn't bad advice. Flippantly rejecting your boss on the other hand could have drastic consequences. – Lumberjack Sep 13 '19 at 14:42
  • 4
    rather blatant duplicate of Can HR/Boss Require Your Username and Password? – gnat Sep 13 '19 at 14:47
  • 3
    @gnat The other question has HIPAA as part of the question, which adds a layer of protection that this question does not. – thursdaysgeek Sep 13 '19 at 15:16
39

(Knee-jerk reaction) Get this request in writing, and forward it to your company's IT information security group. If IT won't let them have it then neither should you.

I've never worked for any company of decent size that allowed this, most if not all of them have annual training that covers this, and per that training password sharing is a major breach.

|improve this answer|||||
  • Yeah, I think I'll play dumb and try this. ty – user109840 Sep 13 '19 at 14:15
  • 6
    Don't know the details specific to your situation that are not posted here, but I'd bet ten dollars that your IT information security group will respond to this by providing your manager some Specialized High-Intensity Training (it's an acronym) about not asking direct reports for email passwords. Good luck. – Jim Horn Sep 13 '19 at 14:33
  • This is good in theory, but the manager can simply refuse to put the request in writing. If this is an at will employment, he can then terminate the employees who refuse for some other reason. – sf02 Sep 13 '19 at 14:53
  • 1
    In any competently-run organization, this manager will be instantly "relieved-reeducated-reassigned-removed" for trying this. It may also be illegal, if it's an organization covered by HIPPA or Sarbanes-Oxley in the U.S. Since the OP says there's an IT department, I'm betting there's some enforcement. – Wesley Long Sep 13 '19 at 15:29
  • Even if he refused to put the demand in writing, if IT's information security group hears from three or more people that he demanded it, even verbally, there will almost certainly be some Special High-Intensity Training scheduled for the manager in question. – John R. Strohm Sep 17 '19 at 18:45
18

This seems very out of the ordinary. Why does your manager want your email password? If he doesn't have a good reason, this can be an example of toxic micromanagement, where your manager wants to snoop into every little thing you're doing, and that's bad. Another reason why you shouldn't give him your password is because, in the event something goes horribly wrong at your job and you find yourself in need of legal assistance, most of the documentation your lawyer will need will probably be in your work email, which your boss (likely the defendant, or at least a defendant, in any such situation) now has the ability to go in and delete without your permission.

DO NOT give your boss your email password. Or, if your boss won't take no for an answer, give him your email password and immediately stop using your work email for anything of even any remote importance, and then start looking for a new job. This sort of micromanagement is not healthy and can be dangerous.

EDIT: Just noticed that the boss already went to IT and IT said they won't let him have your passwords. You should immediately go to IT yourself and let them know your manager is putting pressure on you to give him your passwords directly to go around IT, and see what they say. It's possible your company has some sort of internal measures of what to do in case a manager tries to go around company protocols in this way.

|improve this answer|||||
10

NEVER give passwords out. People who need to see password protected information won't need your password to do it, and if they can't get that clearance, then you shouldn't give the information out.

If you deliberately give or reveal your password to your manager (to anything, not just email), then you're as guilty as he is if that information is misused; in extreme cases, you could both be fired.

In this case, because the IT department has said no, you should also say no, and redirect him to the IT department if he keeps pressing.

|improve this answer|||||
  • This is potentially dangerous advice if your company doesn't have any policies protecting your passwords. In the US at least, an employee has zero expectation of privacy for a company email address. – Lumberjack Sep 13 '19 at 14:44
  • 4
    @Lumberjack 1. Just because the company has a right to read all of your email, doesn't mean your boss does. There are a lot of professional conversations that can be had over email that your boss absolutely does not need to see (eg. HR). 2. It's not just about expectation of privacy, it's about accountability. If your boss has your password, then they can pretend to be you. They could be malicious, and make it look like you're stealing company secrets, or they could be stupid and screw up a relationship with a client. Either way, you are the one to blame because it was your account. – David K Sep 13 '19 at 14:53
  • @DavidK Everything you say is accurate, but if your boss demands your password and HR takes his side, you'll still suffer the consequences. – Lumberjack Sep 13 '19 at 15:05
  • 5
    @Lumberjack but in this case IT has already made it clear that this violates company policy. Giving out a password against IT policy could get an employee fired too. In an at will employment situation there is very limited protection against incompetent and unscrupulous managers, but that doesn't mean you should simply acquiesce to their demands, since that can get you into trouble too. – Charles E. Grant Sep 13 '19 at 17:08
  • 1
    Pretty sure this manager is the victim of some social engineering in play – DetectivePikachu Sep 13 '19 at 22:04
7

Do not - under any circumstances - give out your password

There are dangers to this that haven't been fully addressed by the other, admittedly mostly very good, answers.

1) Shared passwords with other (non-work) accounts - We all know we shouldn't do this but the reality is the majority of us do. If you have shared your password for this account with other accounts (say, your personal email account), your manager now has that password too.

2) There is NO legitimate reason for this. At all. If he wanted to audit your stuff, there are ways to do that without giving him your password. Same for sending stuff on your behalf. Same for just about any administrative/managerial task you can think of.

3) You are responsible for anything done while logged into your account. This can include legal if the boss decides to use your account for illegal activity. The legitimate way to go about the items in #2 leave forensically traceable logs pointing back to him. Logging in as you does not.

4) There can only be a BAD reason for this. The fact that he has gone to IT, got rejected and is trying to bypass them speaks volumes to the fact that your boss should not have the power he is asking for (see number 3).

Contact IT and HR immediately.

|improve this answer|||||
  • 1
    Re point 4, that boss should not even have the power he has now... – Solar Mike Sep 13 '19 at 17:46
2

If you have the right relationship with your boss, first step is to explain why this is such an awful, terrible, no-good, very bad idea. Whatever he thinks he wants to solve with this can very likely be done more securely or is more nefarious than what he should be doing.

I'll also parrot that getting these requests in writing and working with your IT, compliance and/or HR departments to make the case should be considered.

This is a red flag on your boss. It may be for the best of intentions, perhaps coverage in case someone is out or other innocuous reasons. Even that is a terrible idea if you work in any industry that gets audited. He's demanding that his team loses accountability and placing security information in a place where attackers have easier access.

This demonstrates both a lack of understanding of the climate of security and a lack of problem-solving and interaction by your boss. Coverage, for example, could be simply done with shared inboxes/distros or a host of other collaboration tools.

From there, the story just gets worse. He may be wanting to audit all of your interactions or maybe even use your accounts to do things you would not want to be blamed for.

|improve this answer|||||