Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

To simplify the user experience , if we want to design a system such that the user login password for the desktop account itself can be shared with various applications like chat/email/skype etc.

how do we pass credentials across applications without asking the user to give again / seperately . i understand its not safe and can cause single point of failure . but am curious on the technology for credential sharing across applications than single point of failure stuff .

share|improve this question
    
What is your threat model ? –  Stephane Jan 14 at 16:37
    
how to define one ? –  sashank Jan 14 at 16:42
    
The simplest way to do it is to define what your system is, what is exposed to an attacker, who your attackers are, what they can do to compromise your system, and figure out what needs to be protected from there on. –  Karthik Rangarajan Jan 14 at 17:02
    
Also, I don't think there are easy (or hard, for that matter) ways to do what you're looking for. Skype, chat, email, etc. are far too diverse, and use their own forms of authentication, and I don't think you can use a desktop password to automatically log into these accounts, in a secure or insecure way. –  Karthik Rangarajan Jan 14 at 17:04
1  
Why not use old well tried solution for access control: Kerberos. It had enterprise security like things, including passing credentials or ticket granting tickets around for ages. –  user4982 Jan 14 at 18:00

1 Answer 1

If you're wanting something centrally managed across an enterprise domain (i.e. federated identity), then you'll want to look into some sort of solution mentioned here. Identity management is complex, time consuming, and will take a lot of engineering and administrative resources - especially if your users have access to multiple information systems across your enterprise.

If your environment or user base is smaller, or you don't care about centrally managing credentials or a federated identity, you can look in to a utility like Last Pass for Applications

share|improve this answer
    
I don't think he is asking for password managers, but more of a system that logs in to everything using a desktop account. Which wouldn't be possible using federated identity OR LastPass. –  Karthik Rangarajan Jan 14 at 17:09
    
If you're dealing with something that is technology centric (i.e. a Microsoft OS, Skype [owned by Microsoft], and Active Directory [a Microsoft technology], etc...) then you can integrate it all naturally in Windows 8 (windows.microsoft.com/en-us/windows-8/…). I'm pretty sure you can do something similar in earlier versions of Windows (windows.microsoft.com/en-us/windows7/…). –  Dallas Moore Jan 14 at 17:23
    
Yeah, if it is all Microsoft technology, then I can see how you could just use NT credentials for the whole thing. although I am not sure if Skype supports AD authentication yet. Still a tricky setup though. –  Karthik Rangarajan Jan 14 at 17:28
    
If you start binding you AD/local credentials with a MS account, I'm pretty sure the process becomes "seamless" (in a relative sense), but TBH, i've not tried. See the first link in my first reply. But in the end, once we start speaking about AD in the context of managing credentials across disparate information systems or applications... we're now on the path to speaking about federated identity. en.wikipedia.org/wiki/Federated_identity –  Dallas Moore Jan 14 at 17:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.