29

I'm leaving a company I've been with due to the boss reneging on various promises, bonuses, etc. After declining counter-offers and other incentives, the boss started become hostile towards me, and she's now demanding that I hand over account credentials for various company accounts (third-party services for code storage, version control, etc), all of which she can easily reset by logging in as an administrator. She has also demanded that I hand over credentials for my personal email account to make sure I don't have any company emails or IP.

I replied that my personal email is my own property, and that it was never used at the office or for my work. I also noted that the other accounts could simply have their respective passwords reset by using the "administrator tools", and that I will not be providing the logins, as I've already agreed to the legal terms of service for those other websites, which demand I do not share my credentials. I finally noted that she can contact those respective sites for help resetting the passwords, and that there would be no loss of data by doing so.

Did I conduct myself professionally? Are there any circumstances under which I should provide those account credentials (other than my personal email)? Finally, should I just outright tell her "I can't give you those because the only reason you could need them is to impersonate me".

This is in Eastern Canada.

Improve this question
7
  • 15
    You acted professionally. Write up a transition document on how she can use her admin piece to change the password on each of the accounts that need a password reset. Do not turn over your passwords. What is she going to do if you don't? Fire you? – dfundako Mar 14 '17 at 16:39
  • Did I conduct myself professionally? - Is very opinion based. You have already handled the situation I am unsure what you are asking of us that would be on topic. – IDrinkandIKnowThings Mar 14 '17 at 16:40
  • 6
    Nearly all of workplace is opinion-based. – Chris E Mar 14 '17 at 16:45
  • 1
    Do what @dfundako suggested and copy her boss too. This way it will be harder to say were were not co-operative during your transition out. Do not give out you personal account password EVER. – Neo Mar 14 '17 at 17:25
  • 2
    I have never worked in an environment where giving personally assigned credentials to anyone, including a boss, was not a security violation. If the boss has legitimate need for access, then there should be avenues in place for them to gain access without your cooperation. As for personal account, no, they have no such rights, but note that if you have ever accessed those accounts from company machines that internal software could have recorded those credentials. It such is in place, some jurisdictions have ruled they can be accessed to verify you have not committed security breaches. – dlb Mar 14 '17 at 17:35
40

Any security professional would state the obvious: If it is a personal account, do NOT give your credentials to her.

She is able to reset the passwords via IT for your work machine, and she is able to legally obtain subpoena if they decide to take you for court for having confidential documents. If they don't want to take that step, then they have no need of your personal credentials. If they're concerned that you have confidential information, then it's up to them to obtain the legal documentation and authorization to obtain them.

If they're concerned that you will be able to access third-party code, then they can (a) change the login information on their end and/or (b) go the legal route if they think you've been in there. Since the documents are in a third-party repository I'd doubt that organization would jeopardize themselves by collaborating with any nefarious activities.

Do NOT accuse her, even tangentially, of wrongdoing. Simply state the facts and leave it at that. You're not required to give reasoning to retain your personal information. Even the passwords you DO use for your work account can sometimes be considered private information, as people routinely reuse common passwords across their accounts. If they have the ability to reset them, then they shouldn't be worried about anything.

Improve this answer
8
  • 10
    If it is a personal account, do NOT give your credentials to her. Slight disagreement: I would say simply do NOT give your credentials as general advice, regardless of the account being personal or not, the simple reason being that users tend to reuse passwords. – rath Mar 14 '17 at 16:51
  • 2
    You never give out passwords. Part of my job is assistant sysadmin in my company, and any and every time I need access to any account, I will get it. I do not need or want to know anyone's password and any sysadmin who claims to need to isn't worth his salt. – user308386 Mar 14 '17 at 17:01
  • 3
    When leaving my previous employer, I reset all of the passwords for all employer accounts to a generic 10 character password that I left with my boss on my last day. I did it as a courtesy because they are nice people and I NEVER use accurate personal information to secure any work account external to my employer. – DLS3141 Mar 14 '17 at 17:03
  • 2
    @rath Yeah, that's what I said in the last paragraph. Personally, they never get anything. Reset and go on, hire a hacker to piece it out or go to court and have them force me to give it...and be assured every other password is going to change before any of that happens. – SliderBlackrose Mar 14 '17 at 18:36
  • 3
    And NEVER NEVER NEVER give them access to any personal accounts – DLS3141 Mar 15 '17 at 17:27
13

No. Never. Not even work passwords.

Passwords are private. We sysadmins and software vendors go to extreme lenghts to make sure they can never be viewed by anyone but the password holder, and it's for good reason.

If there are any accounts she needs access to, she can have IT reset them. This is the (only) legit way to get access to passwords upon employee departure. They should definitely be changing them anyways, since you'll no longer be working there.

As for your personal email password, such a request is absurd. Tell her she can come back for that if she has a court order subpoena in hand.

Improve this answer
1
  • 1
    this is the correct answer in my opinion. – Kilisi♦ Mar 15 '17 at 5:08
11

If your company has a password policy and/or acceptable use policy for computing resources, now is a good time to review it.

Personal accounts - she has no business asking for those credentials, and providing them to someone who isn't you may constitute a breach of the Terms of Use for those services.

Work accounts - the company should have mechanisms in place to reset those credentials after your employment has terminated (and from your post, it sounds like this is in place). Those processes should include logging of who did it, when, and for what reason(s). There should be no need for your manager to get your actual password - and this is where the aforementioned policies will come into play. In many organizations, it's a violation of that policy with consequences potentially as severe as termination if an employee is found to be using someone else's credentials, or sharing their credentials with others.

While the email account may be owned by the company, that does not give your manager carte blanche to look at everything in it. For example, communications between you and HR may be considered confidential and not available to her - yet if she has access to your account, that confidentiality would be broken. Let IT and HR handle the "archived" account (your email account should be deactivated and no longer accepting new messages upon your termination) and use tools at their disposal to locate specific messages your manager might need - she shouldn't be permitted to go on a fishing expedition with your email just to "see what she can find."

Practically speaking, you may have to give up the work account passwords just to move past this. But stand firm on your personal account(s). If she really thinks she has any business poking around in there, she can file the appropriate paperwork to pursue it through the legal system.

Improve this answer
4
  • 3
    Good point on the HR communication. For that matter, the manager should not have access to the account for just this reason. It should be turned to HR and IT, who are trained to handle the situation as well as preserve important information (usually confidentially, but I don't speak to all companies) – SliderBlackrose Mar 14 '17 at 16:48
  • 1
    @SliderBlackrose good addition. IT will be equipped to look for specific information in that account (the manager would need to specify what they're looking for), and not just go on a fishing expedition. – alroc Mar 14 '17 at 16:51
  • 1
    Even if you have to give up the work account passwords, you can always just ask the boss what they'd like the password to be changed to before you "tell them the password". The difficult part to figure out, if the company doesn't audit anything, is how to get on record that it's not your account any more, it's your boss's. – Steve Jessop Mar 14 '17 at 17:44
  • 2
    @alroc, As a IT Security professional, I love the securoy focused nature of your response. +1 for mentioning policies and least privilege – Anthony Mar 14 '17 at 18:41
9

Are there any circumstances under which I should provide those account credentials

Only to law enforcement under a court order (and under duress).

The accounts might belong to the company but passwords are personal. End of discussion. If she wants to make sure you have no company IP in your personal email, she can hire a computer forensics company.

I can't give you those because the only reason you could need them is to impersonate me

Spot-on.

edit: Related question on Security.SE: Is it OK to tell your password to your company's sysadmin?

Improve this answer
1
  • 1
    It's not OK to tell your password to anyone ever. Not law enforcement; not under duress. – zzzzBov Mar 16 '17 at 1:21
2

It sounds like you're concerned she wants to pin a sin on you. If so, you should definitely not say "the only reason you could need them is to impersonate me", as that could let her build a case for wrath.

Others have given great advice for the wider issue, but if she's determined to find fault, the easiest solution might be to let her build a case for sloth instead:

Resetting the password for an old account is recommended because it guarantees I can no longer access anything I'm not supposed to. It also means I can use similar passwords elsewhere in future.

Obviously you should never actually reuse passwords. But by mentioning impersonation obliquely then steering the discussion towards a hypothetical "safe" sin, you can give her room to fill in the blanks for herself.

Improve this answer
2

If your boss insists on being given passwords to your work accounts, and you don't want to give here those passwords (for example because you used the same password for personal accounts), instead of fighting him / her about the matter, you could change all your passwords to Password123. Or maybe ask IT to suggest a password and change all your passwords to the password they suggest. And hand that password over.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .