2

Can my manager ask for my passwords? I’ve been working for an employment agency (privately owned) for 2 weeks as a Recruiter Account Manager. I received an email from my manager, asking me to email over all my passwords that I use for their programs. She asks so casually to others as well, like it’s no big deal. Isn’t that a violation of some sort? I feel as if they are getting ready to fire me or worst, mess up the work that I’ve done.

8
  • Are these passwords to accounts they own (like your work email address, work time tracking, etc)? Commented Jun 10, 2023 at 10:34
  • 1
    Does this answer your question? Manager is demanding everyone's email passwords - how to proceed?
    – gnat
    Commented Jun 10, 2023 at 11:15
  • 2
    @JoeStrazzere While not knowing the specific details, there may be sensitive information protected by those passwords that the OP's manager may not/should not be allowed to see. In addition, the manager may be using such access to spy on the OP (and other employees), which doesn't engender a lot of trust. If anything, the only person who should have the password is the OP. And if required, IT should be able to override the OP's access.
    – Peter M
    Commented Jun 10, 2023 at 17:29
  • 4
    @JoeStrazzere Isn't it basic security that you don't hand over passwords to programs that you use? After all, once you've done that any auditing is no longer useful, since someone else can impersonate you. For example, another dev could check in a backdoor using my credentials.
    – DaveG
    Commented Jun 11, 2023 at 1:25
  • 1
    @JoeStrazzere Maybe I was unclear. When I said "Isn't it basic security that you don't hand over passwords to programs that you use" I wasn't implying that handing over passwords was against the law. I was merely pointing out that sharing passwords in a company is right up there with having all your passwords on paper taped to your monitor. Not a good idea.
    – DaveG
    Commented Jun 11, 2023 at 19:46

6 Answers 6

14

Can my manager ask for my passwords?

Can they ask? Yes. But that is a red flag in so many ways.

You mentioned one of them:

"I feel as if they are getting ready to fire me or worst, mess up the work that I’ve done."

but there are others:

  • Asking them to be emailed is never good. Email is not secure.
  • There are tools to store passwords if they are needed to protect company assets or if they are needed in an emergency.
  • There needs to be a admin level account that can access all the company owned accounts to protect the company.
  • There needs to be an admin level account to manage accounts, which is needed when new employees are hired, or others are leaving.
  • If they have your login, then the tracking system will assign responsibilities for actions done with your password to you.
  • Treating individual accounts like a group account could be a sign of a company trying to save money charged by 3rd parties for access to their tools.

First, don't send the passwords. Talk to your manager, but not by email. Then talk to IT or somebody that is responsible for corporate security. They could have a legitimate need for some of this, but might not be doing it the best way.

1
  • 3
    I don't know why this got down votes.
    – C'est Moi
    Commented Jun 10, 2023 at 20:11
5

Can my manager ask for my passwords?

Yes.

Isn’t that a violation of some sort?

Depends on your internal company and IT policies. The company has every right to access your work accounts that they pay for. Typically this is handled by your IT department (if you have one). In most places, your manager can access your accounts, but would have to go through IT who would in turn formally log the request and access. Other companies are more relaxed about this type of thing.

We don't know what your company's policies are. Read your employee handbook or talk to your information security manager (if you have one).

Sending passwords by e-mail is not best practice and it's not particularly safe, but it's only a violation if you have a policy that says it is.

I feel as if they are getting ready to fire me or worst, mess up the work that I’ve done.

That feels overly paranoid. The company ALREADY has access to all your accounts (whether you aware of it or not) so if they wanted to do anything nefarious it would be stupid of them to highlight this by explicitly asking for passwords.

1
  • "The company" and "the manager" are not the same entity, and there is a difference between "the company has the ability to override your access" and "your manager has your login and password and can impersonate you". If anything, I think that the company's already-existing ability to override the OP's access only makes the manager's request even more suspicious.
    – Stef
    Commented Jun 13, 2023 at 14:11
5

You first ask whoever is above your manager about this. Then you tell the manager that you want this request in writing (that is on paper with a signature). Make sure that they know and understand that if they have your password then anything going wrong with your account makes them a suspect. For example, an email from your email account containing company secrets makes them the main suspect. Which allows you to do anything with plausible deniability. Very bad for the company.

Last, if your passwords are personal then change them to something that isn’t before you hand them over.

It may very well be that IT can access your accounts without knowing your passwords, so there should be no reason ever to have your password.

2
  • 4
    The OP already has the request in writing, since it was done via email. But personally, I would make sure that the boss's email account hasn't been hacked. If an intruder hacked her email account, asking for passwords from her underlings is a natural next step in escalation. Commented Jun 10, 2023 at 17:45
  • 2
    In this case, yes I actually meant in writing = sheet of paper with a signature.
    – gnasher729
    Commented Jun 10, 2023 at 18:24
3

As others have indicated, it's obviously "bad practice" to casually hand-over passwords. If these applications are truly operated by the employer, they would not need employees to email passwords to their managers.

More likely than not, this just means the company lacks good IT administration. It happens, especially in smaller shops. And you probably will need to just do as the manager asks.

It's totally OK, however, to question this.

The fact that the OP feels this is weird should override any sense of "obedience". The boss should have to explain WHY they're doing this. If they don't... well, that's another, much more serious red-flag.

2

Two points.

  1. The company has the right to access the data you create during your work. But that should be done via administrator access. Your password is also your ID. The evidence that what is written in a document or in an email was written by you.

  2. Your password might also be private data. Although discouraged people might have reused password used for private services. Or password may give a clue to the password style used by a person.

More on point 1. In a big company you do not give your password to anyone, not even your boss. Because if something bad happens the user ID that did something bad is linked to the worker. Someone might impersonate you, it happens when someone want to do something risky and does not want to take responsibility for it.

In a small company things might be more relaxed and people may share an account to do some work. Maybe your boss wants to know the password to be able to take over when you are not there. But it still begs some question. Is this the reason? If it is just to control that the work is done properly why don't they use an admin account? You can ask few question and in case let them know the password. But at this point you should be sure that everyone else is aware of it and they should understand that anything done with your user id might be done by other people.

More on point 2. The style you choose to define a password might be used to guess what kind of passwords you might have for your private accounts. Before telling the your password you better change them in such a way that they have nothing to do with your private passwords.

0

This raises a lot of red flags. Besides the answers from Hilmar, mhoran_psprep and gnasher729 about the IT already having access to your data and why it is a bad idea to send your passwords over email, I would like to talk of a very real risk to you in doing this. Giving your password to somebody else allows them to log in to your computer or other company devices as you and do things as they were you. They could do things that were against company policies or even illegal and it would be very hard for you to prove that it was not you who did this when the logs in your company's servers say that you were logged in when it happened. Your manager might have no ill intentions, but I have seen people in some companies that would not be above that. I would raise the problem with the IT department, they should be able to provide that manager with all the access they need without compromising your password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .