How do I ask the employer for a confirmation that access was revoked to accounts that weren't mine?

Question

When I'll leave I will be asking for an official letter confirming that my accounts on the server, mails etc. were disabled so they can't blame me if something happens (I don't want to be held responsible if they forget to disable the accounts and third-party uses mine).

However as a developer I had access to many clients accounts whose credentials I was not only encouraged but clearly ordered to use it multiple times for testing (weak password hashes, easy to lookup in google).

What do I to keep myself covered if something happens with those accounts? They won't ask several thousand people to change their passwords but I'm not the only one with access and I'd rather keep myself covered if several years from now some ex-employee decides to destroy something I originally created.

Answer 1

Well, you can just ask, but...

• The company owns that account, not you, so they can do with it what they wish. The fact that you're given control of it is a coincidence of your employment. It's a mistake to ever think that it's "your" account. Never was.
• I wouldn't worry unless you think there's a concern that you'll be framed. In which case, I guess, just send a formal letter saying that you'd like to receive confirmation that the account was disabled/deleted, etc., but I don't think that gives you any extra protection against framing.
• How are they going to blame you for something done under one of the accounts that they own, after your employment ends? Keep track of any official documentation of the last day of your work and let it be. It's their job to secure the account.

Now (and I'm not saying you're going to do this), but if they didn't disable the account, and you were to log in and do something malicious to "prove a point" about their weak security...well you might think you're doing some good, but you will have also committed a crime that will probably get you in a lot of trouble. If you have major concerns over security practices then you need to make it clear in some written form (an email, where you print out any responses you get would probably suffice, then take them with you when you leave). Just don't cross into the "I want to prove a point" realm and commit any crimes, because, well, you'll land your ass in jail.

And besides, you can't fix people's stupidity that way. It's futile.

What is it, exactly, that you're trying to protect against that is a real, credible threat? As soon as you walk out the door, even if they send you a letter at some point, someone internally could reset the password to that account, or even disable it and re-enable it later and reset the password, and then take control. I don't see how having a letter confirming that the account is disabled will do any good, since the account is still their property, not yours, and it's ultimately their responsibility to secure it.

How is having such a letter in your possession any different than having documentation of what your last day of employment was?