3 ms·

Credential sharing is common, most see it as a way to achieve an end, rather than as a security hole that could screw them over in the future. If your not very

Credential sharing is common, most see it as a way to achieve an end, rather than as a security hole that could screw them over in the future. If your not very technical, and your intern needs to respond to your emails, schedule your calendar, and handle other tasks I'd be surprised if most don't just fork over their login details rather than go and ask Jerry in IT to make an account with all these special permissions for an Intern or staffer that'll be gone in a few months to a year.

robin_reala 9y ago
Which would be inadvisable but understandable, were it not for the code of conduct that stipulates that you do not share passwords. It might be a common thing to do, but this matter needs at a minimum a reiteration of the rules and better documentation of the correct alternatives, and probably also a certain amount of punitive measures.
- draugadrotten 9y ago
  Biometrics solves this particular sharing problem; the politican can´t easily share their iris or fingerprint In my experience, 2factorA with cell phones also prevents executives from sharing passwords. They won´t leave their phone behind. However biometrics is faster to use and easier to understand for most people. 2FA can be socially engineered by calling the politican/exec and asking for the code they just got "for support". That won´t fly with a fingerprint.
  - StudentStuff 9y ago
    A gummy bear works just fine to copy a fingerprint. You can only go so far too, piss off a politician or even a lower level boss, and IT may find all their computers in the dumpster, replaced with new PCs that said person bought to get the job done, rather than fight IT to get their work done. For most people, a computer is a means to an end. If it doesn't accomplish that task, the computer belongs in the trash.
    - draugadrotten 9y ago
      > A gummy bear works just fine to copy a fingerprint. No longer. You may be pleased to learn that there is new technology that is better than that. Google "liveness detection" to learn more. > For most people, a computer is a means to an end. If it doesn't accomplish that task, the computer belongs in the trash. If I interpret your hyperbole nicely, you mean that security which is difficult to use will upset users. Indeed this is so, therefore security needs to be implemented in such a way that it is easy to use in a secure fashion. apple touchID is a good real-life example of which you may be aware. Enforcing complex text passwords which must be changed every N days is a counter-example which does not achieve the desired effect and also upsets users. Biometrics are, when implemented well, very easy to use and far more secure than text passwords. Therefore they should be considered, before "throwing the computer in the dumpster", as you said.
- StudentStuff 9y ago
  Definitely, but even that won't fix the issue. Fact is, its so painful to get each user the proper access rights via IT, to the point that nearly no one complies with the code of conduct they agree to. The easier you make things, the more apt people are to properly securing their systems. Saying they didn't follow policy, while true, is ignoring the root cause of why the policy wasn't followed.
  - draugadrotten 9y ago
    > nearly no one complies with the code of conduct they agree to Your organisation has a problem which could lead to financial or reputation loss. Is management aware?
    - astura 9y ago
      We've already established management doesn't care, otherwise we wouldn't have these massive data breaches (practically) every other week and IoT devices with zero security and open access to the world. At a company I worked at 10+ years ago the IT Dept had a generic VPN username/password that they gave out like candy to use if you needed to VPN in and your account was in the process of being setup. It wasn't like this practice was a secret either. I don't know why it took more than a few minutes (?) to setup VPN access.
alistairSH 9y ago
Credential sharing is common, most see it as a way to achieve an end I recently learned a relative, who works at a law practice, shares her login. But, like the MP, there is a business need. In this case, some piece of software that isn't "in the cloud" - it's a local installation. If she's out of the office, somebody has to run the software. It didn't occur to her, or anybody else at the office, that other employees can likely access the software on that PC with their own logins (they never tried). It never occurred to them to request assistance from the software vendor. Sharing credentials was the obvious (and easy) solution. It's a small-town office, average age of employee is probably well north of 50. I probably shouldn't have been surprised, but I was.

robin_reala 9y ago

Which would be inadvisable but understandable, were it not for the code of conduct that stipulates that you do not share passwords. It might be a common thing to do, but this matter needs at a minimum a reiteration of the rules and better documentation of the correct alternatives, and probably also a certain amount of punitive measures.

draugadrotten 9y ago
Biometrics solves this particular sharing problem; the politican can´t easily share their iris or fingerprint In my experience, 2factorA with cell phones also prevents executives from sharing passwords. They won´t leave their phone behind. However biometrics is faster to use and easier to understand for most people. 2FA can be socially engineered by calling the politican/exec and asking for the code they just got "for support". That won´t fly with a fingerprint.
- StudentStuff 9y ago
  A gummy bear works just fine to copy a fingerprint. You can only go so far too, piss off a politician or even a lower level boss, and IT may find all their computers in the dumpster, replaced with new PCs that said person bought to get the job done, rather than fight IT to get their work done. For most people, a computer is a means to an end. If it doesn't accomplish that task, the computer belongs in the trash.
  - draugadrotten 9y ago
    > A gummy bear works just fine to copy a fingerprint. No longer. You may be pleased to learn that there is new technology that is better than that. Google "liveness detection" to learn more. > For most people, a computer is a means to an end. If it doesn't accomplish that task, the computer belongs in the trash. If I interpret your hyperbole nicely, you mean that security which is difficult to use will upset users. Indeed this is so, therefore security needs to be implemented in such a way that it is easy to use in a secure fashion. apple touchID is a good real-life example of which you may be aware. Enforcing complex text passwords which must be changed every N days is a counter-example which does not achieve the desired effect and also upsets users. Biometrics are, when implemented well, very easy to use and far more secure than text passwords. Therefore they should be considered, before "throwing the computer in the dumpster", as you said.
StudentStuff 9y ago
Definitely, but even that won't fix the issue. Fact is, its so painful to get each user the proper access rights via IT, to the point that nearly no one complies with the code of conduct they agree to. The easier you make things, the more apt people are to properly securing their systems. Saying they didn't follow policy, while true, is ignoring the root cause of why the policy wasn't followed.
- draugadrotten 9y ago
  > nearly no one complies with the code of conduct they agree to Your organisation has a problem which could lead to financial or reputation loss. Is management aware?
  - astura 9y ago
    We've already established management doesn't care, otherwise we wouldn't have these massive data breaches (practically) every other week and IoT devices with zero security and open access to the world. At a company I worked at 10+ years ago the IT Dept had a generic VPN username/password that they gave out like candy to use if you needed to VPN in and your account was in the process of being setup. It wasn't like this practice was a secret either. I don't know why it took more than a few minutes (?) to setup VPN access.

alistairSH 9y ago

Credential sharing is common, most see it as a way to achieve an end I recently learned a relative, who works at a law practice, shares her login. But, like the MP, there is a business need. In this case, some piece of software that isn't "in the cloud" - it's a local installation. If she's out of the office, somebody has to run the software. It didn't occur to her, or anybody else at the office, that other employees can likely access the software on that PC with their own logins (they never tried). It never occurred to them to request assistance from the software vendor. Sharing credentials was the obvious (and easy) solution. It's a small-town office, average age of employee is probably well north of 50. I probably shouldn't have been surprised, but I was.