In my workplace, sometimes my boss reactivates my computer from hibernation and reset my password to get into my Windows account.
I know that the computer belongs to the company, but I'm used to save my passwords in that computer, and I'm worried about what he can do with them.
The reason he uses to justify this, is that sometimes he wants to know if there is anything uncommited in my computer, so he can commit in my name.
He should have access to the computer, but not the accounts.
From your description, he specifically wants access to the accounts to act in your name. This should violate your IT department's policies for two reasons.
Check your IT policy, most places have a rule that this is not ok, ever.
Two things to think about:
if you were discussing a complaint about your boss with HR, they would be able to find out.
if your boss has access to you machine and breaks something, it will appear to have been you that did it.
In every place I have ever worked, this behaviour is completely against company policy for the reasons outlined above. It opens the company up to potential legal issues should they ever decide to dismiss you.
So I take it boss is coming in as an Admin and resetting your password so he can log in as you. The act of resetting a password is recorded. The account that resent you password is recorded along with the time.
This just makes no sense. If he can come in as Admin then he can view all files. There is no purpose to log in as you unless the intent is to impersonate you.
The reason he gives is
He wants to know if there is anything uncommitted in my computer, so he can commit in my name.
That is not a reasonable purpose. If the code was ready to commit then you would have committed it. If he wants to commit the code then he should do it under his name.
I get maybe an emergency build but not accepting this should happen on a regular basis.
It is company equipment so in US probably legal. It would not pass any legitimate IT policy. A user not in IT to have Admin rights is not common. For developers some times they are in IT and some trusted developers are given Admin rights but they are expected to not use those writes to change passwords and log in as that person.
Others have already mentioned why someone committing code without knowing why you didn't do it is stupid and that using your account is high probability against company policy. In some jurisdictions illegal.
But you hinted that your primary concern is stored passwords. Put them in a password manager program that requires a "master password" (which only you know) to get to them, such as password1 or KeePass (or Firefox). And if possible, put that app and its DB on a USB stick.
As you pointed out, the company owns the computer. Since they own the computer, your manager or anyone with the authorization and admin rights can log into your computer as long as they aren't abusing the access in such a way to jeapoardize your job. Rule of thumb is don't keep your personal financial information or resumes on your computer. Let work be work so as to not just protect your personal information but to limit the damage that can be done if someone with access did attempt malicious activity under your name.
In one of my previous environments, it was commonplace for managers to access their employees computers because people kept project files and customer mortgage documents locally on their machine; so when that person was out sick and the customer needed to change their closing date, a manager had to access that employees computer to get the original document. Archaic system I know, but that's just one case of legitimate reason a manager would need to access an employees computer.
This depends on the country and the specific IT policies in place.
In the UK, by default this would NOT be acceptable. Your boss would be entitled to monitor your work activities, but if you had logged into your personal email account, your boss would not be entitled to monitor that.
However, to counter this, it is standard practice to include a clause in your contract or acceptable use policy that says "company equipment cannot be used for personal use". If that clause is present, then your boss IS entitled to monitor all usage of a work computer.
Many countries have similar laws to the UK, but there are notable differences. For example, in Germany you have a stronger right to privacy.
Source: I've worked in infosec for some years and have learned this on various courses I've attended (e.g. SANS). I'm afraid I don't have links immediately to hand, but you should be able to find them easily enough.
The simple answer is don't store your passwords on your computer or use some kind of keychain application that doesn't use the login password system.
As other people have mentioned, your manager is probably not compliant with IT security policy. It might be worth tactfully mentioning to your IT support that your password has been reset on multiple occasions and let them take whatever action.
Something missing from the other answers so far, is that in the case of uncommitted changes, it should not be your boss who commits them and that is not a reasonable excuse. I'm thinking in terms of software development versioning systems but this is equally applicable to legal documents or other "vital" work that might need to be committed in a timely fashion: how does your boss know that the changes are complete, tested, verified, ready, etc ?
The reason he uses to justify this, is that sometimes he wants to know if there is anything uncommited in my computer, so he can commit in my name.
While I doubt this is true, if it was this should be handled differently.
Setup a shared drive where the work related content resides. Or setup a policy that the work related files in your account in a special directory are read-only accessible by other employees. etc
There are plenty of ways to allow access to the files in question that do not make it necessary to impersonate you in any way.
It might be reasonable to create such system/policy, so that work related files can be accessed in case of an emergency for example where you would be unavailable.
I would ask the boss why this is not an option.
There are three levels to this.
Level 1: Does my manager have the right to access MY work computer? That depends. Your company will have defined what rights anyone in the company has. Your manager has that right if the company says he has the right, and he doesn't have the right if the company says he doesn't. I would agree with my manager accessing my computer let's say if I had an accident and there was important information only on my computer. If it happened without a very good reason I would be very, very angry and that wouldn't be a good thing.
Level 2: What about my privacy? Depending on the country where you are, private information may be strongly protected, even if it is on a computer owned by the company and that shouldn't be on that computer. Or it may be totally unprotected on your work computer.
Level 3: Legalities. And here we have a big, big, red flag. The CEO of your company has no right whatsoever to access the computer of his accountant. Your manager has no right whatsoever to commit changes under your name. As a software developer, the uncommitted code on my computer is under development, and at any point in time it could be in a state that could be between costly and fatal if committed and shipped to customers. (I might write software that ships goods to customers, sends a bill to the customer, and records that the customer owes the company money. If only two of these three parts are finished, and my boss commits this unfinished work, that would be fatal). There are many industries where access to data is strictly controlled and what the boss is doing here could cause criminal charges and enormous liability for the company.
The security breach nonsense is just that, ridiculous nonsense.
You enter a password on a private computer, hence it may or may not be available to its owners. If there is a domain set up, it may or may not be in plaintext on the domain controller already. The password is not your secret, it is a shared secret. Shared secrets allow for trusted and possibly encrypted channels to be established. That's not your identity!
It's my company, I may as well set up an account with identical user names and passwords on each of my computers, which everybody knows, and who is to say its not within my right to do so? I worked in such an environment, there was no trouble whatsoever. It's not your call.
Putting someone's real name in the real name field of some domain account changes nothing, it is not nearly enough to prove anything in court. No, even if your boss have not ever logged in (which is basically improvable), that IT guy fed up with stupid stuff probably has superuser rights and could do whatever he wants and no one will ever know.
The idea that company-generated credentials automating authentication and delivery of access to company-owned infrastructure and information that the company willingly shared with you to automate some work processes in the way the company sees fit somehow entitles you to anything is blatantly, irrefutably absurd.
The company can set up whichever automation and authentication procedures it wants and yes, your boss can do whatever they wants. Unless, of course, their boss says they can't, then you go to their boss.
Surely, nothing implies whether these are some good or bad practices in some particular senses. That's for the company to decide, not you.
Surely again, if we're talking some kind of fraud, that's whole other issue. Logging into your company-provided e-mail account may be A-OK, but sending an e-mail to your wife with your signature at the end is not.
Please notice it is not necessary to log into any of "your" accounts to do so, but that still constitutes wrongdoing.
Committing the code you wrote in working hours on company's private computer, which you got paid for, to company-owned repository and build farm is A-OK (from whichever corporate account the company wants it committed from), but adding malicious backdoor code and then claiming you did it is not.
Please notice it is not necessary to log into any of "your" accounts to do so, but that still constitutes wrongdoing.
See where I'm going here?
