Comment by bambax | Hacker News Reader

Comment by bambax | Hacker News Reader

It's a question of education / culture.

I run an SMB and as such, have a personal access to manage the company's account on the French govt taxes website.

My accounting firm does this for me. The govt website has this perfectly covered, with delegation and dedicated roles for accountants, other company officials, etc.

Yet when we first set this up the first thing my accountant told me was: just give me your credentials so I can log in as you. I said no, I don't think so. Instead, tell me your account # so that I can authorize it on my account. And he said "I don't even have an account. I do this with all my other clients".

In the end he set up his own account and we did it the right way, but it took time, and it was absolutely not obvious to him that sharing personal "admin" login information was a very bad idea.

I don't think there's a technological solution to this problem, unless maybe if delegation can be made to happen automatically (how???) and if there are biometric sensors that make sharing login information impossible (but that would annoy people more, not help them).

Maybe if we get enough leaks the culture will change ? Usually the best motivator for change is making big mistakes.

To be fair I think leaks could happen with delegation setup mentioned.

I agree - I think the point is that with enough leaks, you really want to be able to pin down what person was acting based on the credentials used.

E.G. I'll never giveaway my credentials again if last time that happened it caused a leak.

    > and if there are biometric sensors that make
    > sharing login information impossible (but that
    > would annoy people more, not help them).

Just add 2-factor-authentication tied to their phone. You can use Google Authenticator (RFC 6238).

That one is easy, simply share the secret.

The system is setup not to reveal the secret once it’s set. Technical users can root their phones to extract the secret of course, but most users wont be willing to go that far.

You can of course set up a new secret & share it with multiple phones at that point. Not sure there’s much you can do to stop that using a software 2FA implementation. If it really matters, then a hardware token is the way to go.

The 2FA secret is just a URI, nowadays embedded in a QR code and easily photographed or scanned using any of the 2d barcode scanner apps.

Then generate a session id and invalidate the URI after first use.

It’s not a URI. The google-authenticator pam library generates an image that encodes the secret which gets echoed to the terminal as a QR-code. No internet access required - just a camera on your phone to image the code.

If you can take a photo of the code & re-use it, then you can initialise multiple phones with the same secret.

> I don't think there's a technological solution to this problem

Lol of course there is.

1: IP alerts - new IP? email alert.

2: 2FA - should be standard, requiring a physical device to login

3: Deterrents; seems slightly fishy? You need to login to the account by proving you are the owner.

With AI it's not so difficult to detect if it's a genuine login (browser fingerprinting, UA strings, version numbers, OS versions etc).

You don't need AI. A simple fuzzy string match and some basic rules around it (ie, allow 25% fault across all tests, so your useragent can change 20% and the other strings can change 5% without you needing to reauth).

The simplest defense is to never log the user out and only ask passwords for special things (like Github's Superuser Mode)

Those would only help limit login sharing; they're not solutions to the problem of making account delegation easier to do (and to understand).

I think from most people's perspective all those things do is make login sharing harder. I'm working with a non-profit to set up a website and social media accounts, and I've explained the concept of everyone having their own login to a shared account 3 times, and I think maybe 1 person gets it. (And maybe I suck at explaining it, but I have plenty of teaching experience and usually get compliments on explaining technical stuff in a non-jargony way).

If these same people had the obstacle of having to add another person's phone to 2FA as well as share the password, they still wouldn't look very long at alternatives to the way they log in. There's a fundamental assumption that there's a way to log in, and other people just have to do that. Very hard to help them realize that everyone should authenticate as individuals, and you can authorize individuals to access the group's resources.

The issue here is still culture. What's an IP, and why isn't this alert going to IT instead of me? 2FA can be added to multiple devices still allowing delegation. People will throw a password into anything that prompts them.

I always think about people who say that verification keys in emails is the route to go[0] to stop phishing/fraud attempts. It's a technological method that ensures the message is sent from a specific source, but that doesn't mean that the user will always verify the key.

We've had the technology to stop most commonplace security issues for a while. We've almost always been lacking in culture.

[0]: https://news.ycombinator.com/item?id=14219272

Reply on news.ycombinator.com