A few weeks ago, my desktop computer developed a fault, and despite several attempts to restore it, the problem persisted. The IT personnel had to temporarily assign me another desktop while working to resolve the issue with my original computer.
The replacement desktop had previously belonged to a former staff member. With the IT personnel’s assistance, I set up an account and began working on it. However, when my original desktop was eventually restored, I had to log out of the temporary computer and ensure that my accounts were no longer accessible on it.
It was during this process that we discovered something concerning: although the previous user had logged out of his accounts, some of his passwords had been saved in the browser. These credentials were not immediately obvious, and removing them required us to look beyond simply logging out.
The discovery raised an important question: how many of us leave behind digital information that could expose our personal or professional accounts when we stop using a device?
Saved passwords: Convenience or security risk?
Saving passwords in a browser can make everyday online activities easier. Instead of remembering multiple credentials, users can allow their browsers to store and autofill them when needed. However, this convenience can become a security risk when passwords are saved on shared, borrowed or reassigned devices.
Cybersecurity professional Mr Daniel Odame Kofi Bampoe explains that he rarely saves passwords in web browsers because of the potential security implications. When he does, he limits the practice to his personal computer and accounts he considers less sensitive, rather than banking or email accounts.
His approach highlights an important distinction: the risk is not simply whether a password is saved, but where it is saved, how the device is protected and who might gain access to it.
A password stored in a browser may remain available even after its owner has logged out of a website. Depending on the browser’s security settings and the device’s protections, someone with access to the computer may be able to retrieve or use those credentials. This is particularly concerning in workplaces where computers may be transferred between employees.
Bampoe therefore advises users to avoid saving passwords in browsers where possible. If saving them is necessary, he recommends protecting the device with strong login credentials and seeking guidance on clearing saved passwords before the computer is reassigned.
For anyone preparing to hand over a device, this means checking the browser’s password manager and autofill settings, removing stored credentials and signing out of accounts. Users should also review saved sessions and other personal data. Where a device is being transferred permanently, the organisation’s IT personnel should follow the appropriate process for removing the previous user’s data and preparing the computer for its next owner.
Logging out is only the first step
Logging out of an account is an essential security habit, but it should not be mistaken for a complete removal of personal information from a device.
Browsers may retain saved passwords, autofill information and other browsing data after a user signs out of a website. Some services may also remain signed in through active sessions. The precise risks depend on the device, browser and account settings.
Before returning a borrowed computer or handing over a work device, users should review the accounts they accessed and remove any personal information that should not remain on the machine. On shared workplace computers, employees should avoid saving credentials and seek assistance from their IT department when necessary.
The same caution applies when lending a personal laptop to someone else. A simple act of kindness should not inadvertently expose private emails, financial accounts, work documents or other sensitive information.
Think before you click
While saved passwords can expose accounts through device access, cybercriminals also use deceptive messages to trick people into revealing their credentials.
Mr Samuel Boakye Oworae, an IT professional, identifies suspicious emails, links and attachments as an important area of concern. He advises users to exercise caution when unexpected emails, SMS messages, WhatsApp messages or social media communications ask them to click links, open attachments, provide passwords, confirm bank details, send money or share verification codes.
Such messages often create a sense of urgency, suggesting that an account will be blocked, a payment will be lost or immediate action is required. This pressure can cause recipients to act before checking whether the request is genuine.
Before responding, users should verify the sender and the message. On a computer, hovering over a link may reveal its destination, but this should not be treated as proof that the link is safe. If a message appears to come from a bank, employer or service provider, it is safer to contact the organisation through an independently verified phone number, official website or application rather than using the contact details or links supplied in the suspicious message.
Oworae also recommends seeking guidance from a trusted IT professional when uncertain. Most importantly, passwords and one-time verification codes should never be shared simply because a message claims that doing so is necessary to protect an account.
This Cybersecurity Awareness Month, let us make online safety a daily habit rather than something we consider only after a problem occurs. Sometimes, protecting ourselves online begins with checking what we leave behind.
DISCLAIMER: The views, comments, and contributions made by readers or contributors on this website do not necessarily represent the position or views of The Sikaman Times. The Sikaman Times will not be responsible or liable for any inaccurate or incorrect statements made by readers or contributors on this website.
