I am developing a tool for a company, that takes some technical data and creates PDF reports.
In the tool you have several text fields, which get filled by the database. If the user wants to, he can change the contents of the textfields. In the end, he presses a button and some reports get created, archived and send to the customer.
My boss made the proposal to just use a group password for everyone, so every user of the tool knows the password and simply has to enter his own username.
I refrained from this and told him, this would be convenient, but unsafe mainly for the reason of Identity theft: someone can simply enter another username than his and input the textfields with nonsense, that gets send to the customer, print a report 300 times, create the report 500 times, etc.
We discussed this a little bit further and after he realised, that an attacker indeed could do some damage, at least to the reputation, we tried to find a scenario, where such a group password would be acceptable.
This got me curious: are there environments or situations, where such a group password would be acceptable? Or will it always get shot down with the "identity theft"-argument?