3 ms·
This begets a new problem. The hotel gets "an" account for Booking. We now need to provide a 2FA credential that essentially needs to be accessed by any hotel
by kotaKat 3y ago
This begets a new problem.
The hotel gets "an" account for Booking. We now need to provide a 2FA credential that essentially needs to be accessed by any hotel front desk/office staff. What methods do we use for "many 2FA, one account"? (And then, how do all those second-factors get secured? Email accounts? Shared phones? Shared token? Shared Authenticator?).
It's probably bad enough the password's probably on a post-it under the front desk keyboard, but I don't think the average hotelier is going to be standing up something like Delinea Secret Server. ;)
- dietrichepp 3y agoThe ideal solution is that each of the front desk / office staff use their work credentials to access booking.com. One customer accounts, many user accounts. Use OIDC so you’re not entering your work password on booking.com. I know it’s not gonna happen industry-wide. But this is how we do things everywhere I’ve worked for the past many years.
- isotopp 3y ago"We" don't. "We" need to create individual accounts for each eligible staff member and provide each with a 2FA system, for example a Fido key or a TOTP auth app, or an app that uses push notifications and asks for a "yes".