They are criminally insecure because you know useful passwords after ceasing to be authorized: they neglected resetting them. Of course, if asking someone thei

They are criminally insecure because you know useful passwords after ceasing to be authorized: they neglected resetting them. Of course, if asking someone their passwords is a normal operating procedure, they were probably criminally insecure from the beginning. Recommendation: tip the appropriate parties (customers, certification and government agencies, etc.) and nuke them with audits.