Forum: workplace.stackexchange.com
Tags: <manager><email>
Title: Manager is demanding everyone's email passwords - how to proceed?
Question: My manager told all of us today (~10 person team) to make a paper list of our work email passwords for him. Someone else told him he can get it from IT, and he said IT wouldn't let him have them. How should I/we proceed with this?

Answers:
sents: text: (Knee-jerk reaction) Get this request in writing, and forward it to your company's IT information security group.
text: If IT won't let them have it then
text: neither should you.
text: I've never worked for any company of decent size that allowed this, most if not all of them have annual training that covers this, and per that training password sharing is a major breach.
answer_details: author: workplace.stackexchange.com/users/84055/Jim Horn
score: 39
sents: text: This seems very out of the ordinary.
text: Why does your manager want your email password?
text: If he doesn't have a good reason, this can be an example of toxic micromanagement, where your manager wants to snoop into every little thing you're doing, and that's bad.
text: Another reason why you shouldn't give him your password is because, in the event something goes horribly wrong at your job and you find yourself in need of legal assistance, most of the documentation your lawyer will need will probably be in your work email, which your boss (likely the defendant, or at least a defendant, in any such situation) now has the ability to go in and delete without your permission.
text: DO NOT give your boss your email password.
text: Or, if your boss won't take no for an answer, give him your email password and immediately stop using your work email for anything of even any remote importance, and then start looking for a new job.
text: This sort of micromanagement is not healthy and can be dangerous.
text: EDIT: Just noticed that the boss already went to IT
text: and IT said they won't let him have your passwords.
text: You should immediately go to IT yourself and let them know your manager is putting pressure on you to give him your passwords directly to go around IT, and see what they say.
text: It's possible your company has some sort of internal measures of what to do in case a manager tries to go around company protocols in this way.
answer_details: author: workplace.stackexchange.com/users/88183/Ertai87
score: 18
sents: text: NEVER give passwords out.
text: People who need to see password protected information won't need your password to do it, and if they can't get that clearance, then you shouldn't give the information out.
text: If you deliberately give or reveal your password to your manager (to anything, not just email), then you're as guilty as he is if that information is misused; in extreme cases, you could both be fired.
text: In this case, because the IT department has said no, you should also say no, and redirect him to the IT department if he keeps pressing.
answer_details: author: workplace.stackexchange.com/users/22932/PeteCon
score: 10
sents: text: Do not - under any circumstances - give out your password
text: There are dangers to this that haven't been fully addressed by the other, admittedly mostly very good, answers.
text: 1)
text: Shared passwords with other (non-work) accounts
text: - We all know we shouldn't do this
text: but the reality is the majority of us do.
text: If you have shared your password for this account with other accounts (say, your personal email account), your manager now has that password too.
text: 2)
text: There is NO legitimate reason for this.
text: At all.
text: If he wanted to audit your stuff, there are ways to do that without giving him your password.
text: Same for sending stuff on your behalf.
text: Same for just about any administrative/managerial task you can think of.
text: 3)
text: You are responsible for anything done while logged into your account.
text: This can include legal if the boss decides to use your account for illegal activity.
text: The legitimate way to go about the items in #2 leave forensically traceable logs pointing back to him.
text: Logging in as you does not.
text: 4)
text: There can only be a BAD reason for this.
text: The fact that he has gone to IT, got rejected and is trying to bypass them speaks volumes to the fact that your boss should not have the power he is asking for (see number 3).
text: Contact IT and HR immediately.
answer_details: author: workplace.stackexchange.com/users/77409/520 says Reinstate Monica
score: 7
sents: text: If you have the right relationship with your boss, first step is to explain why this is such an awful, terrible, no-good, very bad idea.
text: Whatever he thinks he wants to solve with this can very likely be done more securely or is more nefarious than what he should be doing.
text: I'll also parrot that getting these requests in writing and working with your IT, compliance and/or HR departments to make the case should be considered.
text: This is a red flag on your boss.
text: It may be for the best of intentions, perhaps coverage in case someone is out or other innocuous reasons.
text: Even that is a terrible idea if you work in any industry that gets audited.
text: He's demanding that his team loses accountability and placing security information in a place where attackers have easier access.
text: This demonstrates both a lack of understanding of the climate of security and a lack of problem-solving and interaction by your boss.
text: Coverage, for example, could be simply done with shared inboxes/distros or a host of other collaboration tools.
text: From there, the story just gets worse.
text: He may be wanting to audit all of your interactions or maybe even use your accounts to do things you would not want to be blamed for.
answer_details: author: workplace.stackexchange.com/users/99671/SemiGeek
score: 2

Summary of the answers:
You should never give your email password to your boss. You should contact HR and the IT department and explain that your manager is putting pressure on you to do this.
Firstly, do not provide your boss with your password under any circumstances. To deal with this, if you have a good relationship with your boss, you may want to politely explain to them why this is a bad idea. However, failing this, you might want to report the incident to IT or even HR.