Work Email logins when I was off

[gnaughton]

Hi all,

today at work I I was on a shared computer that is located in my managers room.

I opened google chrome to login to my webmail. I noticed my username was pre-populated which seemed odd as I hadn’t use this machine since last Sunday.

I checked the history and have so far found 27 instances of when my webmail account was logged into, and at least half the times it was within a minute or two of my manager’s account having been accessed. I am fairly sure it is my manager who seems to have been logging in to my account.

I have never given him my password. I checked Chrome to make sure I hadn’t previously saved the password, and I definitely hadn’t.

Is he allowed to do this? Do I have any legal recourse and if so what action do I need to take? Is it a criminal matter and do I need to report it to the police?

So far I have taken no action. I don’t want to reveal the fact I have made this discovery to anyone at work in case they tip him off and he tries to cover his tracks.

I have taken screenshots of the Chrome history. Will that be sufficient evidence if he does delete the history on Monday morning?

Many thanks in advance

[ostell]

So Chrome has saved your userid and password, as it is designed to do. Go into chrome and remove your userid and paaword from the saved passwords in settings. Turn off password saving if this is a shared machine Use incognito mode of chrome so that it doesn't save anything at all and leaves no trace. Or set yourself up as a seperate user on the computer, which is what you should be doing anyway

And of course change your password

[gnaughton]

Thanks Ostell. Sorry I think I didn’t explain properly.

I defintely hadn’t saved my userid and password in Chrome - thats what I checked. So whoever has been logging into to me webmail at work on the work computer, while I am sat at home, has to have obtained my password by deceptive means.

As I said, all the evidence points to it being my manager.

So really, what I want to find out it a) has he broken the law and b) what action do I need to take?

[ostell]

Chrome appears to default to saving login info, useful on a one user machine.

So how could he gave obtained your password, if chrome is not retaining it or is it guessable?

I don't think showing the log will prove anything one way or another, especially, as you say, when you are using it you get presented with your login details.


I presume you both use the the same webmail service so when he logs out the system fills in your details so giving the appearance of him logging in to your account following use of his account.

[gnaughton]

It certainly isn’t guessable. It was auto generated by the IT manager when I joined and is permanent - ie you are not asked to change it on regular intervals (not very secure).

The worst case scenario is he put a keylogger on but he has never struck me as IT savvy. Fact he left history for me to find and didnt hide is tracks would be proof of that.

My guess he has given IT some story about wanting to check up on me and they have given him my login details.

If that was his plan then he was barking up the wrong tree as I only use it for legitimate work stuff. However for about a year I have had a number of disputes with him that have resulted in HR getting involved. In all of them I was able to provide detailed accounts of incidents based on my email history, and this meant he wasn’t able to get his way. So on reflection it is easy to see why going forward he would be desperate to access my emails so he can be pre warned going forward and twist things to his own agenda.

[ostell]

So request a password change, use an incognito tab, disable login detail saving and create your own login ID for the computer. Ask your IT group if they can provide a current password. Probably no, a forgotten password can usually only be resolved with a new password.


P.S. remind IT that passwords should be changed once a month.

[Aged William]

The OP may wish to see if the employer has a 'Lawful Business Monitoring' policy as it may give a definition of unacceptable or unauthorised activities.

[gnaughton]

Good shout William. I need to keep my powder dry till Monday when my union rep is back in. Was wondering whether legitimate or not, arent they legally obliged to tell the person whose email account they are monitoring of the intention to do so?