Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
I was outsourced. Can former co-worker keep requesting passwords? (workplace.stackexchange.com)
2 points by nsoonhui on Oct 27, 2022 | hide | past | favorite | 4 comments


If I were in their position, I would put all passwords needed by the team in a Keypass file and transfer it to the manager in something that has an audit trail and require the manager to have the team change all the passwords for each system, then have the manager share the updated passwords when I return to active duty.

Ideally this would never be required in the first place if passwords for humans were managed in a centralized secure system and server-application-service accounts that for whatever reason require a password were managed in an HSM based management system that services authenticate to. Role based access should allow humans to reach things related to their job role by group membership. Individual accounts can be disabled when a person is on leave or traveling to a sanctioned country.


They are criminally insecure because you know useful passwords after ceasing to be authorized: they neglected resetting them.

Of course, if asking someone their passwords is a normal operating procedure, they were probably criminally insecure from the beginning.

Recommendation: tip the appropriate parties (customers, certification and government agencies, etc.) and nuke them with audits.


Just as the top answer on stackexchange says, telling your former coworker passwords is legally idiotic. It might, in some scenarios, slightly help you. But the downside is huge. If something went really wrong - what better scapegoat could there be than "a former employee, who somehow knew the secret passwords...".


Ghost them..




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: