44

Three months ago, I was suddenly (for me) told I was outsourced, a business decision. After this, I got vacation, etc. plus a severance.

It was sudden for me, but upon reflection I realize they were quiet about firing me, because the consulting company kept asking for server, information and passwords, etc., and then I discovered I was being excluded from meetings I should have been included on that my former coworker was included on.

My former coworker keeps asking me for passwords. A few I remembered and provided, and I know other passwords were documented on the laptop computer I ethically returned.

I'm no longer an employee, so I think from now on my answer should be 'No.' On some previous requests I simply did not reply and the requested information was found anyway.

Particularly for today's request which I really don't remember anyway and it's annoying because I am no longer an employee!

I am sure I documented it and they will find it.

This coworker offered to provide a reference (he claimed to be surprised what happened. I actually think he was in on it, but I don't have any proof), so I also feel like I have to stay on his good side. I only have two other references.

4
  • 1
    Comments are not for extended discussion; this conversation has been moved to chat.
    – Kilisi
    Oct 26, 2022 at 22:25
  • 4
    What do you mean by "I was outsourced"? Usually it's work that would be outsourced, not people... Do you mean you are now an employee of another company doing the same work for your former company? Or do you mean you were laid off?
    – komodosp
    Oct 27, 2022 at 11:26
  • 2
    @komodosp it means that he was laid off and its former job was assigned to a third party company.
    – o0'.
    Oct 27, 2022 at 18:16
  • @o0'. As discussed in comments now moved to chat, that's probably correct but I'd really like to see a response from the OP rather than assuming what they meant. Oct 27, 2022 at 19:22

16 Answers 16

193

If it wasn't part of the severance agreement, I don't think you are required to do anything for that company.

You can even make a claim that information security policies prevent you from doing so because you have no way to verify that are entitled to that information after you left the job. If they use your passwords, they might later blame you if something goes wrong if the password transfer is not documented.

5
  • 40
    Further, granting secrets of this nature to individuals not authorized to possess them is a breach of security. Be mindful of the penalties for breaching corporate security: they are not necessarily limited to the duration of your employment.
    – Mike Hofer
    Oct 25, 2022 at 12:46
  • 2
    If I have the access, I'll shut off my account or even get them locked by repeatedly failing them. I don't even WANT access after I left, regardless of whether they remember to turn them off or not.
    – Nelson
    Oct 26, 2022 at 14:59
  • 3
    @Nelson, I wouldn't even want it showing up in the logs that I was attempting to access the system (to fail the logins and lock the account).
    – spuck
    Oct 26, 2022 at 22:01
  • 5
    @spuck Yeah, you're right. That's probably not a good idea to lock your own account. Best to email the admin, cc your own boss and HR, and tell them to shut off your account.
    – Nelson
    Oct 27, 2022 at 1:39
  • Information security policies certainly should prevent OP from doing so, but it seems unlikely that they have good security practices. If they did, they wouldn't be asking an ex-employee for passwords. and those passwords wouldn't be usable if they did. Oct 28, 2022 at 0:25
104

You have left this company. Your only response now should be "I do not remember, nor do I have saved copies of, any passwords".

Make that true; if you have a 'password book', delete it. If you have 2FA for any systems, remove the 2FA item from your device. If you know a password to a system, and could potentially still access it, then you would be prime suspect if that system were ever compromised. Do not let yourself be caught in that situation.

6
  • 8
    This! Especially since OP doesn't seem to particularly trust the former colleague. If you even admit to knowing any passwords, you are leaving yourself open to accusations.
    – Auspex
    Oct 26, 2022 at 13:45
  • 4
    And, this answer does not burn bridges. Oct 26, 2022 at 17:33
  • 6
    Came here to write this answer. Well done! Admitting you still have passwords could tangle you up with hacking charges (if anything happens they could blame you). Also you are subsidizing an absolutely horrible security model that you should not support in any way whatsoever. Oct 26, 2022 at 22:36
  • 6
    I would be shocked if your termination agreements etc, DIDN'T include a clause or agreement that you disposed of / deleted all of the company passwords that you had, and / or that you didn't have them recorded anywhere other than on the company machines which you've clearly surrendered. Clearly, you obeyed those provisions, CORRECT? Doing anything suggesting otherwise woud be ill-advised. Oct 27, 2022 at 3:20
  • 1
    Two additional points regarding SSH keys: #1 - Don't install personal SSH keys on any company servers. #2- If the company requires you to access their servers from your home computer (not that common any more) then generate a new SSH key for that employer and copy the private key to your home computer. That way when you leave you can delete the corporate private key from your computer in the same way that you delete your password book.
    – DavidT
    Oct 27, 2022 at 22:31
68

You are no longer employed by them.

Either get them to pay you for your consultancy OR refuse further contact.

10
  • 23
    And by "them", Solar Mike means the company, not the random person asking for passwords. Oct 25, 2022 at 12:55
  • 21
    "I'll be happy to help with that issue. My consulting fee is $100 per hour, with a minimum of 4 hours."
    – Kevin
    Oct 25, 2022 at 13:35
  • 19
    I'd be careful with the payment approach. In some jurisdictions, offering to provide passwords for a fee could be viewed as extortion. Much simpler just to decline. Oct 26, 2022 at 0:52
  • 2
    @LaconicDroid is correct. Feel free to offer to consult for them -- it's their fault they didn't get as much from you as they need before they walked you out the door -- but not specifically to offer passwords for a price.
    – Auspex
    Oct 26, 2022 at 13:38
  • 1
    @LaconicDroid IANAL, but how could this be perceived as, or constitute, extortion? My understanding is that extortion requires coercion or duress - simply capitalising (quite literally, heh) on a situation falls far short on that; and the OP’s former employer is well within their means to initiate password resets all by themselves (…assuming they didn’t outsource all their technically competent people) so it’s not like the OP is holding the company to ransom.
    – Dai
    Oct 27, 2022 at 4:34
45

I was outsourced, can former co-worker keep requesting passwords?

You are asking the wrong question. Obviously, former co-workers can ask for anything.

Instead you should be asking if you should supply passwords when asked.

The answer is clearly "No".

First, you are no longer employed there so it clearly isn't your job. Second, you shouldn't even know the current passwords - they should have been changed when you left.

Either ignore the requests, or just say "No".

9
  • 25
    Yeah, the fact that they are asking for passwords makes it weird. You don't even know if the guy asking for the password is supposed to have the password. He could be a disgruntled former employee too at this point! I'd probably cut some slack for calling up and asking about, say, some obscure config file option, but passwords make it weird.
    – JamieB
    Oct 24, 2022 at 22:12
  • 2
    Oh I know who the person is. I know the password is somewhere within the laptop I returned, no idea where though, my stuff was well organized, he probably found it already. Therefore I chose not to reply and he has not yet said anything, his new server management can just rebuild vSphere if they can't find what they want.
    – Parkaboy
    Oct 25, 2022 at 1:08
  • 30
    @Parkaboy you know who he is, but since you don't work at the company anymore, how do you know he's still authorized to receive the passwords?
    – Esther
    Oct 25, 2022 at 1:11
  • 4
    Indeed. Just say "no." And the OP should have said "no" from the start. In addition, the OP might (as a gesture of goodwill) get in touch with his former manager and tell him/her this is happening and it makes him uncomfortable.
    – Wastrel
    Oct 25, 2022 at 14:54
  • 6
    +1 for company should've changed the passwords. Long accepted practice in enterprise IT is to change admin/access passwords right-before, or at the same time as, the person is being terminated. In information-security, even minutes can cause a lot of harm.
    – MandisaW
    Oct 25, 2022 at 22:15
30

Since it sounds as though you did a proper handover of your passwords etc when you left you can just respond politely:

All the login & password information I had has already been provided to X as part of my handover.

This is of course assuming you want to be polite - at this point you can just ignore them. If there's any login info you didn't provide at handover then refusing to engage can put you in a difficult position but if they (i.e. your former employer) has everything one way or another you can block/ignore the requests and carry on with the next phase of your career with a clear conscience and a spring in your step.

4
  • 4
    If there's any login info you didn't provide at handover then refusing to engage can put you in a difficult position Why? The handover conclusion was accepted by the company and the contract is over. I would refuse any consulting engagement about this because it implies I did not hand over everything (possibly on purpose)
    – WoJ
    Oct 25, 2022 at 9:01
  • There is no evidence for this in the question, but if OP intentionally tried to sabotage the company because he was being forced out, that would be an issue. Say they had no access to an important server that OP set up, and the password they have does not work, and OP refuses to provide the password, and they later find out that OP changed the password the day they left to something that is not recorded, that would be an issue. Oct 25, 2022 at 22:34
  • The fact that the employee keeps coming to him for passwords and he apparently provided some in the past leads me to believe they didn't have a good system for recording passwords, that some of them might be only in OP's head, and that OP did not diligently provide the employer with important information that would be needed by his employer after he left. Oct 25, 2022 at 22:37
  • 1
    @JasonGoemaat Various jurisdictions will have different thresholds on liability for damages. Some require malicious intent, others just require recklessness. So I think you are correct, and it goes even beyond what you have said. Oct 26, 2022 at 9:07
19

The appropriate way to answer this is:

I'm sorry, but I transferred all information and knowledge, including passwords, when my employment was terminated. Please do not continue to ask about this information, as I am no longer an employee of [company]. Further requests will not be answered.

This should be reasonably polite and not burn bridges with anyone who is being reasonable. Of course, there's no saying how it will be received by the specific person here, and they might not be reasonable.

2
  • 5
    +1 not burning bridges and staying professional is on longterm always the best choice! Be polite, direct and clear.
    – Mayou36
    Oct 25, 2022 at 12:11
  • 1
    Make sure it's in writing/timestamped (company AND personal email). Legally, you're responsible for anything you still have the passwords to, and the former employer / coworker can blame you for anything in your absence.
    – MandisaW
    Oct 25, 2022 at 22:17
14

If you are asked for a password, then ask yourself: Am I supposed to know that password? Normally when you leave your access to anything should be locked down, and the passwords that you know should be worthless. I wouldn't admit to knowing any passwords.

1
  • 9
    Right. When an employee leaves, all the passwords he knew or might have known should be changed as a matter of good practice.
    – Wastrel
    Oct 25, 2022 at 14:55
7

My former co-worker keeps asking me for passwords. A few I remembered and provided,

This was your first mistake. You should have said that you didn't remember them the very first time you were asked. And you should have repeated a similar phrase every time the same request was made.

I think from now on my answer should be 'No.'

Now your answer should be: "I've given you a notebook with all my passwords, and I've told you everything I could remember."

Be a broken record if you have to. It's not that difficult. Just don't adjust your response and don't try to justify yourself to try to gain his approval, otherwise, his requests will keep on coming.

But at the same time, take him up on his offer to give you a reference before his offer evaporates. Ask for a LinkedIn reference and offer to write a LinkedIn reference in return. https://www.themuse.com/advice/your-5minute-guide-to-writing-an-amazing-linkedin-recommendation

Worst case scenario, his LinkedIn reference is not that good and you don't show it on your profile since you have the power to hide it if you don't like it. Best case scenario, he writes you a pretty good LinkedIn reference. Also, if any potential employer calls him, he will feel obligated to stick to what he wrote on your LinkedIn just to be consistent.

(claimed to be surprised what happened, I actually think he was in on it but I have no proof)

So who cares if he was in on it?

Are you really telling us that if the situation had been reversed you would have told your colleague about the upcoming replacement?

And yes, he could be lying to you about his prior knowledge. But again, people tell each other white lies all the time. I'm sure you have as well.

I understand the hurt of being laid off, but do try to let go of that bitterness. It doesn't do you any good to blame him. Take him up on his offer and ask for a LinkedIn reference, but do tell him that you don't remember the passwords, which is the truth anyway. And to make the situation reciprocal, offer to give him a good LinkedIn reference in return.

But if he asks you anything else that's work related, just spell it out for him. "If this LinkedIn recommendation is contingent on me remembering a three months old password, then don't write one for me, because I can not give you what I don't remember". Or if he asks only about work, say: "If this LinkedIn recommendation is contingent on me consulting for free for a former employer three months after I was laid off from that employer, then please don't write such a recommendation for me."

And if you're still have trouble saying "No", I'd suggest you read this book When I Say No, I Feel Guilty by Manuel J. Smith. Personally, that book changed my life.

6
  • 3
    Maybe OPs former co-worker finds it easier to contact OP than to go through the official ways of asking IT to reset all those passwords.
    – gerrit
    Oct 25, 2022 at 6:21
  • 1
    I mean, I'm not sure on the "either the passwords are too simple, or you kept a copy of them for personal records" - I can remember the (very secure) passwords from a few places I've worked, because I use easy to remember but secure password generating schemes, and because if you're working on linux servers, eventually something will brick badly enough that you have to log in in single user mode. The difference here is that former places of work changed everything when I left. Rest of your answer is great though!
    – lupe
    Oct 25, 2022 at 9:53
  • 1
    @lupe, You're right. I've amended my answer. Oct 25, 2022 at 18:53
  • 2
    "Are you really telling us that if the situation had been reversed you would have told your colleague about the upcoming replacement? No, I don't think so." I've been in that situation, the guy who got kicked out is still a good friend, and I would absolutely have risked my job and told him if I'd known it was coming. He told me he was going out for lunch (five years ago), and he still hasn't come back :)
    – Auspex
    Oct 26, 2022 at 13:48
  • @Auspex, Fair enough. It really does depend on the relationship you have with that colleague and on several other factors. Oct 26, 2022 at 16:05
4

Whether you documented the passwords or not, password management is an organization responsibility, not the responsibility of a singled employee. You owe them nothing more. If it were me, I'd simply ignore the requests.

4

I was outsourced, can former co-worker keep requesting passwords?

They can request whatever they want, that doesn't mean that you need to honor or acknowledge their requests in any way.

I have left companies where former coworkers would occasionally message or call me asking for work related help after I had left. The former coworkers that I kept in touch with and had good relationships with I had no issue helping them at all. The former coworkers that I did not care for, I never replied to their messages or answered their calls.

As for the reference, anyone offering a reference on the condition of your continued help after you have left the company is not worth it.

0
3

From now on assume you do not have any passwords.

First, they should have rotated them once you left.

You are probably in legal breach if you keep company information with you.

Finally, I would never accept a contract gig (as suggested elsewhere) for such assignments - you reveal that you kept that information and did not provide it at handover.

Do not reply to their requests, wait for a legal request that will never come because it makes absolutely no sense.

11
  • 2
    How would the OP be in legal breach if they knew a password which wasn't rotated? Should they beat themselves on the head with a baseball bat until they forget? Oct 25, 2022 at 12:58
  • 1
    @GregoryCurrie: they were told during the handover to pass all credentials they had. They did not, and now want a consulting gig to provide it. This could be borderline and this is why I would never accept a contract position for that purpose. Of course if the company wants them to help run something, or reconfigure or whatever then fine. Since they leave the company on bad terms I would not take the risk and say that I do not have any other passwords and if I even had, I have forgotten them. The whole thing is a circus of course and the company is not serious - thus my careful treading
    – WoJ
    Oct 25, 2022 at 14:10
  • 1
    Right. But they will still "keep" the company information even if they hand it over, unless the passwords are reset. I would also say that if you were meant to handle credentials over, and didn't, and then "forgot" the passwords, they certainly can sue you over it. The remedy would include quantities of cash to compensate for the effort and costs of recovering the accounts/data as opposed to handing over the passwords. Oct 26, 2022 at 0:59
  • 1
    @GregoryCurrie: once you leave the company after the handover and the company is fine with the outcome, it is the duty of the company to protect itself (by rotating the passwords). From your perspective, anything related to the company has poof gone from your mind. Sure this is a cosmic situation, but do not forget that this company doesn't know how to reset their passwords, which means they are simply incompetent to the core. Plus OP was fired.
    – WoJ
    Oct 26, 2022 at 8:35
  • 2
    @GregoryCurrie: also, I work in IT. There are really, really few systems for which the password cannot be recovered (some PKI vaults come to mind) - otherwise for IT systems passwords are resettable. Of course if we talk about data then you can have encryption and without a password you are done is you did not prepare for that.
    – WoJ
    Oct 26, 2022 at 8:38
3

When you say "outsourced", do you actually mean outplaced (i.e. dismissed), or do you mean you have been transferred to another employer but continue to provide services to your old employer?

If you're not working for your old employer at all anymore, and if you've parted on amicable terms, then it isn't impolite for your colleague to make perhaps one or two brief and non-urgent queries over the following few months.

Compare this to the few moments that might be required to send out a prepared written reference, or field a telephone call from a new employer seeking a reference.

Obviously, they must expect your memory to start to fade, and that contacting ex-employees is a last resort.

Also, if the questions are indeed spurious or used as a shortcut for only modest work, it might be appropriate to remind them that you are no longer employed there. "Come on, John, they let me go three months ago! I'm sure you could figure this out yourself. I like to do favours, but I only really want to be contacted as a last resort.".

If the real problem is that you don't really have amicable feelings about your old employer (or indeed this particular colleague), then it might be appropriate to broach that directly. "You know, John, I was quite surprised to be let go, and I wasn't really happy about it, so I'd like to put it all behind me. You've contacted me X times already about my old work, and I really think this should be the last time".

1

It's reasonable to ask a former employee for a password when the parting was amicable - you'd want someone to return the favor if you were in a tough situation. But this is the kind of thing that should only happen once, under dire circumstances (the password cannot be retrieved or reset any other way).

It sounds like you've been more than generous about this, and they need to respect your ability to move on.

1

Usually, the answer is no, but there are exceptions.

Plenty of answers have already explained the most common case which is that you should not have to provide a password to a person who no longer employs you, but this is not always the case. The big exception to this is when your job involves non-core products. Your company probably had all sorts of company wide products everyone uses. Office 365, G Suite, etc. These are things thier IT department should have set up for you when you got there, and that the IT department should be able to properly handle when you leave with or without your cooperation.

However, there are also cases where you may have personally set up products that other employees had nothing to do with at all (due to the unique requirements of your position) and no way of recovering on thier own. Maybe you were the only one who ever had those credentials. Maybe you set up something and the 2FA for it is only on your phone. Things like that can keep an IT team from taking control of the company's intellectual property, even after you've turned in your physical equipment.

In cases like this, you may have a legal requirement to comply after your employment is terminated. In all likelihood, your contract contained language saying that anything you developed in the employment of that business is thier intellectual property and that it must be turned over at the end of employment. So, if these systems they are asking about would constitute a meaningful failure on your part to turn over thier intellectual property, then refusing to give them the credentials could be seen as Intellectual Property Theft which is a crime punishable with both lawsuits and jailtime in many parts of the world.

There are also other cases where special laws may come in based on the type of information protected by those credentials. Accusations of Intellectual Property Theft can become much more severe if the intellectual property involved contains financial, medical, classified, or personally identifying information.

So when in doubt, it is usually best to comply anyway.

Limitations

Once you turn over the information once, your responsibility is fulfilled. If they are contacting you over and over for the same credentials, then feel free to refuse to answer thier further questions, but if they keep contacting you about different credentials each time, then you should provided them with those credentials and confirm thier ability to access the account each time until all platforms that you used in their employment are properly turned over.

0

The OP is being altruistic, that's natural. He is trying to help out the folks he worked with even though the org rather abruptly outsourced him. It shows good character and reflects well on him.

Boring IT policy issues about password management aside, it's OK to help out former coworkers with an occasional piece of information for a few weeks after leaving. Any more than that, however, and the OP risks being taken advantage of.

If he wants to help out further, the best course of action is to ask the former employer to set-up a consulting agreement with a significant hourly rate and hard limits on the number of hours you help them. What that rate is depends on locale, but for a US based tech firm, it could easily be $200+/hr.

-9

Of course your former co-worker can ask you for passwords, how else do they know if you could be trusted with passwords, and give you a good reference.

My former coworker keeps asking me for passwords. A few I remembered and provided [...] This coworker offered to provide a reference (he claimed to be surprised what happened. I actually think he was in on it, but I don't have any proof), so I also feel like I have to stay on his good side. I only have two other references...

LOL! ROFL! Now you are certain to be getting a strong negative reference, expect your employment to be listed on your credit report for the next few years and kiss your current career BYE-BYE! You just gave sensitive information to someone potentially not authorized, you fell for their trap and now you will have to pay the price, you may even be subject to legal consequences.

I once worked for someone who didn't like me... turns out they hired me for a few hours just so they could list themselves on my credit report and be a negative referral. Trust me, once they get on your credit report, there is no saving your career, it is over. In the USA they can say whatever they want so long as you can't prove it to be false (i.e. slander). If you emailed or communicated the passwords over a phone line then they have actual proof. Seeing as how your employer and coworkers did not like you, none of these things happening to you would surprise me.

4
  • I am not a "new contributor", I just value privacy enough to only use an account a few times per site. Oct 25, 2022 at 21:28
  • 4
    There are some good points in this answer, but overall tone and delivery is not ideal. I would suggest that this Answer should be re-written to focus on the point that some companies and jurisdictions may prohibit an ex-employee giving out any data (even if asked for by the company). Oct 25, 2022 at 23:51
  • 10
    I am not a lawyer and I know that some employers check credit reports during the hiring process, but I'm pretty sure that's not how credit reports work. Oct 26, 2022 at 3:31
  • 3
    I think you've confused a credit report with a background check.
    – BSMP
    Oct 26, 2022 at 19:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .