4 ms·
My suspicion is that what's happened here is that Jeff's daughter has used his laptop for something from school and clicked straight through an overly-inviting
by b800h 4y ago
My suspicion is that what's happened here is that Jeff's daughter has used his laptop for something from school and clicked straight through an overly-inviting message that asked to join the account to the school's domain.
I'm skeptical of the suggestion that the school admins were able to do this with no input, but I'm absolutely willing to entertain the idea that:
a) AD login is a complete mess, and
b) the UI is utterly misleading and near-unusable.
- geoelectric 4y agoHorrible UI if you can do a fundamental account change without some kind of password re-confirmation.
- basch 4y agosaved in the browser
- geoelectric 4y agoYeah, I realize it was just a continued session, but that's exactly what I mean. For things like password changes or privilege changes, there should always be a mandatory re-auth to make sure it's not someone else at keys. This is pretty much just best practice. When's the last time you could change your password without entering the original, short of a re-verification via email? Same idea here.
- basch 4y ago>a mandatory re-auth which, if the persons password is saved in their browser, would pass through to the website, granting a re-auth.
- geoelectric 4y agoOh, I misunderstood what you meant as the session token still being active. I got you now. I've been using 3rd party password managers (with a timeout for a forced reauth) long enough that I forgot when you let the browser do it it's not nearly so locked down.
- curiousguy 4y agoThis makes sense, but this should had ask the account password to confirm, which Jeff’s daughter may know and typed. IMO, The main issue in here is BigTech obsession with a single login. One single credentials give you access to everything, from entertainment to professional services. People do share their credentials with family, specially if involves subscription and payment. BigTech try so hard to push for not sharing, but they fail to understand (or don’t care) that most people, specially non American, don’t have the budget to subscribe multiple time. Family accounts are non existent, lacking management options, and also more expensive.
- mariojv 4y agoIt would be interesting if there were auth standards related to linking family accounts or different identities. OIDC tries to extend OAuth to human identity characteristics but doesn’t quite get there. Maybe you could hack it in with custom claims, but first class support for codifying relations between users would be neat, instead of having every auth provider roll their own half broken implementation.
- trinix912 4y ago> an overly-inviting message that asked to join the account to the school's domain The UI of this is just as bad as the one that asks you to sign into MS account and upload all files to OneDrive when setting up Windows. It even comes back after some time if you deny it! AD login is something that used to work well (10-20 years ago) but is now a complete clusterf*k. What was designed for logging into Windows NT workstations isn't what most users nowadays are expecting when logging onto web apps. Plus the UI full of antipatterns. Yet it's still the easiest for IT folks to manage.
- goosedragons 4y agoI'm pretty sure I did the same thing accidentally when trying to use my university's provided Office365. It bonded onto my personal Live account and was hard and annoying to figure out how to remove.
- MonkeyMalarky 4y agoSame with my spouse when she took a couple of college classes. Which was annoying but whatever until she was done. Then it was annoying pop-ups and alerts every single day because her account at the school was deactivated.