Public computers and services that require an account

Question

I work at a Library Makerspace and we're in a discussion about patron security on the makerspace computers.

We have a lot of patrons logging in to their personal accounts because it's (currently) the only way to download or upload project files. Most often people will log into their email just to download a single file.

Often these emails are left open, but the computers reset enough to make the window of opportunity for an attack pretty small.

I had the idea that it might be nice to have a guest email that is always logged in, so patrons could send stuff to it instead. The obvious issue here is that this email could be abused: peoples addresses could be taken, their files could be seen, etc.

At the same time, having them log into their own accounts is risky too. Nobody here is checking for keyloggers, and I've had plenty of chances to grab a computer before it restarts. I've logged a lot of people out already.

Neither of these solutions seem great.

There's an additional factor of things like "TinkerCad" or "SketchUp" which are web-apps that require a login to use. First time users could be forced to create an account, thus having to login to their email (keylogger time). Or we could have a shared public account and they'll be able to see things other people have made.

In my mind, the risk of someone getting my email address or seeing a file I sent to a public computer is vastly less of an issue than someone getting into my email account. But I've never seen a publicly logged in email on a public computer, and I suspect there's good reason for that too. Emotionally, it seems weird. But logically, is that worse?

What's the worst I could do with a publicly open account? I already know I've had plenty of access to private accounts with the way we're doing things now.

What is good protocol for web accounts on public computers? Is it worse to have a shared one where patrons can see some of each-others stuff, or have patrons risk the entirety of their own private accounts?

Also, just to be clear, expecting random patrons (many of them elderly) to follow proper security protocols is not something I can make happen. This is something a few of my coworkers have suggested... I'm looking for alternatives.

Answer 1

I think it's a good thing for your space to be considering user security. Many organizations face similar issues with shared machines, the big example that comes to mind is universities. Something many colleges have is a dropbox style file retrieval system, where users email their files to an email address, say [email protected], and after the system receives their files, it responds by sending the same email address that sent the file a onetime use pin that can be used to retrieve the file. These are typically used on print servers, where the user can email a file to the printer and get a pin to retrieve their print at a print station, but I have also seen this type of system used in other lab style environments. Now obviously, you would have to put some kind of protection on the system to prevent abuse. For example, users could send very large files and fill up the system, essentially causing denial of service. So, you would have to set up some access controls to only allow certain files and certain sizes. But I think this is a much better option than having users log into their own email accounts and copy over whatever files they want.

As for SketchUp and other software that require first time users to confirm their email address, those users only have to sign into their email account if they don't have another way of accessing it. For example, their phone. They could confirm their email address from their phone eliminating the need to ever sign into their personal account from the shared machine.

Something you may consider is having a fresh installation of windows and whatever other software you deploy, automatically reinstall to the machine every x days. So if someone put a keylogger on the machine, it would only survive for at most x days until the machine reinstalled itself.