31 ms·

You don’t. Whatever tool you want people to collectively use, everyone should have their own account to authenticate, there’s absolutely no need to share a pas

You don’t. Whatever tool you want people to collectively use, everyone should have their own account to authenticate, there’s absolutely no need to share a password ever. It’s a lazy insecure solution implemented by people who either can’t be bothered to do it the correct way, are too cheap to pay for a multi account subscription and rather compromise their own security or simply unskilled and don’t know that everyone can use their own account.

jawns 7y ago
You're talking about what should be the case, not what is the case. In the real world, just as there are plenty of services with poor password practices (e.g. restricting people to numeric PINs when longer-length alphanumeric passwords would be much better) there are also services that don't offer multiple user profiles tied to the same account. It's fine to point out that these services should implement such a feature, but OP's question is about what to do if you need shared access to a service that hasn't yet implemented such a feature.
deleted 7y ago
[deleted]
JimDabell 7y ago
> everyone should have their own account to authenticate, there’s absolutely no need to share a password ever. It’s a lazy insecure solution implemented by people who either can’t be bothered to do it the correct way, are too cheap to pay for a multi account subscription and rather compromise their own security or simply unskilled and don’t know that everyone can use their own account. We develop iOS applications. We have an organisation developer account with Apple that allows us to give each of our team members their own login, complete with varying permissions levels. On a fairly regular basis, Apple updates their license agreement. This requires the account owner to read and agree to the new terms before we can make changes to our account. This is the one permission that cannot be delegated. It has to be the account owner and nobody else on the team can do it. Furthermore, that account must be protected with MFA. We also develop Android apps. We have a similar account on the Play Store. We'd like to connect our API servers to the Google Play developer account so that we can verify receipts for in-app purchases to determine that they are authentic. Doing so requires the account owner to enable this API. No other team member is allowed to do it. The account owner is on holiday / off sick / hit by a bus. How do we do this?
- benjohnson 7y ago
  We have an old android phone for Authy MFA and SMS MFA. It lives in a safe and a few people can get access to it.
oneeyedpigeon 7y ago
This was my first instinct. But what about something like a company Twitter account?
- Jtsummers 7y ago
  For Twitter, use TweetDeck. You can give other users the ability to post without sharing the password. Any competent service provider should be able to set up something similar.

jawns 7y ago

You're talking about what should be the case, not what is the case. In the real world, just as there are plenty of services with poor password practices (e.g. restricting people to numeric PINs when longer-length alphanumeric passwords would be much better) there are also services that don't offer multiple user profiles tied to the same account. It's fine to point out that these services should implement such a feature, but OP's question is about what to do if you need shared access to a service that hasn't yet implemented such a feature.

deleted 7y ago

[deleted]

JimDabell 7y ago

> everyone should have their own account to authenticate, there’s absolutely no need to share a password ever. It’s a lazy insecure solution implemented by people who either can’t be bothered to do it the correct way, are too cheap to pay for a multi account subscription and rather compromise their own security or simply unskilled and don’t know that everyone can use their own account. We develop iOS applications. We have an organisation developer account with Apple that allows us to give each of our team members their own login, complete with varying permissions levels. On a fairly regular basis, Apple updates their license agreement. This requires the account owner to read and agree to the new terms before we can make changes to our account. This is the one permission that cannot be delegated. It has to be the account owner and nobody else on the team can do it. Furthermore, that account must be protected with MFA. We also develop Android apps. We have a similar account on the Play Store. We'd like to connect our API servers to the Google Play developer account so that we can verify receipts for in-app purchases to determine that they are authentic. Doing so requires the account owner to enable this API. No other team member is allowed to do it. The account owner is on holiday / off sick / hit by a bus. How do we do this?

benjohnson 7y ago
We have an old android phone for Authy MFA and SMS MFA. It lives in a safe and a few people can get access to it.

oneeyedpigeon 7y ago

This was my first instinct. But what about something like a company Twitter account?

Jtsummers 7y ago
For Twitter, use TweetDeck. You can give other users the ability to post without sharing the password. Any competent service provider should be able to set up something similar.