8

My manager told all of us today (~10 person team) to make a paper list of our work email passwords for him. Someone else told him he can get it from IT, and he said IT wouldn't let him have them. How should I/we proceed with this?

Improve this question
13
  • 3
    What's the structure of his company? Do you have a security officer or any other authority who would oversee or audit security-related issues? Can we assume the email accounts are related to individuals (i.e. [email protected]) or are they generic (i.e. [email protected])?
    – dwizum
    Sep 13, 2019 at 14:05
  • 2
    Several things needed for this - country? What emails? Is it work or personal (if personal then don't!). Have you asked your manager why he needs them especially if IT say no? Have you explained the security issues around paper copies?
    – MattR
    Sep 13, 2019 at 14:06
  • 4
    rather blatant duplicate of Can HR/Boss Require Your Username and Password?
    – gnat
    Sep 13, 2019 at 14:47
  • 3
    @gnat The other question has HIPAA as part of the question, which adds a layer of protection that this question does not.
    – thursdaysgeek
    Sep 13, 2019 at 15:16
  • 3
    Absolutely do not do this. Your manager is either the victim of social engineering or he is trying to pull something. There is absolutely no legitimate reason for you manager to require your passwords. Ever. For any reason. Full stop. Most likely you will get in major trouble as well for violating security policy if you give it to him. I would honestly go over his head and let his manager know that his direct report is trying to circumvent IT security policies for unknown reasons. I'm sure they'd be very interested to figure out why.
    – DetectivePikachu
    Sep 13, 2019 at 22:01

5 Answers 5

Reset to default
40

(Knee-jerk reaction) Get this request in writing, and forward it to your company's IT information security group. If IT won't let them have it then neither should you.

I've never worked for any company of decent size that allowed this, most if not all of them have annual training that covers this, and per that training password sharing is a major breach.

Improve this answer
5
  • Yeah, I think I'll play dumb and try this. ty
    – user109840
    Sep 13, 2019 at 14:15
  • 7
    Don't know the details specific to your situation that are not posted here, but I'd bet ten dollars that your IT information security group will respond to this by providing your manager some Specialized High-Intensity Training (it's an acronym) about not asking direct reports for email passwords. Good luck.
    – Jim Horn
    Sep 13, 2019 at 14:33
  • This is good in theory, but the manager can simply refuse to put the request in writing. If this is an at will employment, he can then terminate the employees who refuse for some other reason.
    – sf02
    Sep 13, 2019 at 14:53
  • 1
    In any competently-run organization, this manager will be instantly "relieved-reeducated-reassigned-removed" for trying this. It may also be illegal, if it's an organization covered by HIPPA or Sarbanes-Oxley in the U.S. Since the OP says there's an IT department, I'm betting there's some enforcement.
    – Wesley Long
    Sep 13, 2019 at 15:29
  • 1
    Even if he refused to put the demand in writing, if IT's information security group hears from three or more people that he demanded it, even verbally, there will almost certainly be some Special High-Intensity Training scheduled for the manager in question.
    – John R. Strohm
    Sep 17, 2019 at 18:45
19

This seems very out of the ordinary. Why does your manager want your email password? If he doesn't have a good reason, this can be an example of toxic micromanagement, where your manager wants to snoop into every little thing you're doing, and that's bad. Another reason why you shouldn't give him your password is because, in the event something goes horribly wrong at your job and you find yourself in need of legal assistance, most of the documentation your lawyer will need will probably be in your work email, which your boss (likely the defendant, or at least a defendant, in any such situation) now has the ability to go in and delete without your permission.

DO NOT give your boss your email password. Or, if your boss won't take no for an answer, give him your email password and immediately stop using your work email for anything of even any remote importance, and then start looking for a new job. This sort of micromanagement is not healthy and can be dangerous.

EDIT: Just noticed that the boss already went to IT and IT said they won't let him have your passwords. You should immediately go to IT yourself and let them know your manager is putting pressure on you to give him your passwords directly to go around IT, and see what they say. It's possible your company has some sort of internal measures of what to do in case a manager tries to go around company protocols in this way.

Improve this answer
10

NEVER give passwords out. People who need to see password protected information won't need your password to do it, and if they can't get that clearance, then you shouldn't give the information out.

If you deliberately give or reveal your password to your manager (to anything, not just email), then you're as guilty as he is if that information is misused; in extreme cases, you could both be fired.

In this case, because the IT department has said no, you should also say no, and redirect him to the IT department if he keeps pressing.

Improve this answer
7
  • 5
    @Lumberjack 1. Just because the company has a right to read all of your email, doesn't mean your boss does. There are a lot of professional conversations that can be had over email that your boss absolutely does not need to see (eg. HR). 2. It's not just about expectation of privacy, it's about accountability. If your boss has your password, then they can pretend to be you. They could be malicious, and make it look like you're stealing company secrets, or they could be stupid and screw up a relationship with a client. Either way, you are the one to blame because it was your account.
    – David K
    Sep 13, 2019 at 14:53
  • 6
    @Lumberjack but in this case IT has already made it clear that this violates company policy. Giving out a password against IT policy could get an employee fired too. In an at will employment situation there is very limited protection against incompetent and unscrupulous managers, but that doesn't mean you should simply acquiesce to their demands, since that can get you into trouble too.
    – Charles E. Grant
    Sep 13, 2019 at 17:08
  • 1
    @Lumberjack, what you say is true, but if it was within company policy for the manager to be able see his reports' email, he would have had no trouble getting that access through the IT department. They declined his request. The boss is trying to do something shady.
    – Seth R
    Sep 13, 2019 at 17:34
  • 1
    @Lumberjack Having your password means the manager can commit any kind of fraud under your name. You can get into ten times more trouble (like police knocking on your door) if you hand your works password to your manager.
    – gnasher729
    Sep 13, 2019 at 20:25
  • 1
    Pretty sure this manager is the victim of some social engineering in play
    – DetectivePikachu
    Sep 13, 2019 at 22:04
8

Do not - under any circumstances - give out your password

There are dangers to this that haven't been fully addressed by the other, admittedly mostly very good, answers.

1) Shared passwords with other (non-work) accounts - We all know we shouldn't do this but the reality is the majority of us do. If you have shared your password for this account with other accounts (say, your personal email account), your manager now has that password too.

2) There is NO legitimate reason for this. At all. If he wanted to audit your stuff, there are ways to do that without giving him your password. Same for sending stuff on your behalf. Same for just about any administrative/managerial task you can think of.

3) You are responsible for anything done while logged into your account. This can include legal if the boss decides to use your account for illegal activity. The legitimate way to go about the items in #2 leave forensically traceable logs pointing back to him. Logging in as you does not.

4) There can only be a BAD reason for this. The fact that he has gone to IT, got rejected and is trying to bypass them speaks volumes to the fact that your boss should not have the power he is asking for (see number 3).

Contact IT and HR immediately.

Improve this answer
1
  • 1
    Re point 4, that boss should not even have the power he has now...
    – Solar Mike
    Sep 13, 2019 at 17:46
3

If you have the right relationship with your boss, first step is to explain why this is such an awful, terrible, no-good, very bad idea. Whatever he thinks he wants to solve with this can very likely be done more securely or is more nefarious than what he should be doing.

I'll also parrot that getting these requests in writing and working with your IT, compliance and/or HR departments to make the case should be considered.

This is a red flag on your boss. It may be for the best of intentions, perhaps coverage in case someone is out or other innocuous reasons. Even that is a terrible idea if you work in any industry that gets audited. He's demanding that his team loses accountability and placing security information in a place where attackers have easier access.

This demonstrates both a lack of understanding of the climate of security and a lack of problem-solving and interaction by your boss. Coverage, for example, could be simply done with shared inboxes/distros or a host of other collaboration tools.

From there, the story just gets worse. He may be wanting to audit all of your interactions or maybe even use your accounts to do things you would not want to be blamed for.

Improve this answer