2

I have a problem: users share their credentials with other users. I have to create a way to ensure that users are using their own credentials to access the system. I think creating a 2 factor authentication, but I can not use the user's phone. Does anyone know a way to do this through software and not hardware (like biometric device)?

There is a detail that discards solutions about educating users. Some users have reported that their credentials have been stolen and used by former officials, and unfortunately we had a real case with this situation.

  • 1
    2FA is not helping against account sharing. Sure it could... but the most convenient implementation (i. e. rotating code on user smartphone) certainly will not prevent it. Educate your users instead. – BlueWizard Jan 30 '18 at 7:13
  • 6
    You don't solve account sharing by adding more barriers. You solve account sharing by having people not share accounts. That is to say, make people aware they should not, make people responsible for their actions, and allow people to do their job efficiently. – M'vy Jan 30 '18 at 9:12
  • 2
    Is this software used inside some company where you can forbid users to share accounts and send them to training? Or is this accessable by the public (i. e. a webapp) where noone cares what the TOS says? – BlueWizard Jan 30 '18 at 9:46
  • 3
    maybe post a bounty for username-password pairs to be paid by the account-holder – Jasen Jan 30 '18 at 10:18
  • 2
    So if the credentials are stolen then offer a password reset box so the original user can reobtain access and change the password? – BlueWizard Feb 1 '18 at 10:58
8

2-factor logins consist of 2 of three things: something you either have, are, or know. Passwords are something known, so you'd have to implement something you are or have. Biometrics, ie "measuring people"; iris scanners, fingerprint scanners, voiceprints, hand scanners, and facial recognition are examples of biometrics that either require specialized equipment, or can easily be fooled by someone with access to a dollar store. So unless you have a human supervising them, biometrics are out.

So that leaves something you have.

A simple and annoying way to do this is to restrict user logins to their computer. Sure, you know Bob's password, but you don't have his computer. So login fails. That's about the cheapest way t o do it. Otherwise you can issue hardware tokens. Then you'd enter your password and the code from the hardware token or have the hardware token inserted into the USB port.

The challenge to doing this via software is having it be something you have or are. Software by definition is generally neither of them.

PS you already know this, but you have a huge problem with people sharing passwords. Effectively you have no audit trail or way to specifically hold someone accountable for what was done under their login. I assume you already knew that...

  • 1
    Thank you. But, my scenery is very complicated, because restrict user by computer is not possible, the users don't have fixed place, like a "call center". "Biometrics are out, so that leave s something you have.", why? You have biometrics, such as having token hardware or a cell phone. – Carlos Alves Feb 1 '18 at 1:44
  • Anyway, I need a solution by software, I don't have enough time to buy more than 100k of devices be it biometrics, token hardware or cell phones. – Carlos Alves Feb 1 '18 at 2:07
  • 4
    @carlos. biometrics is "measuring people" , iris scanners, fingerprint scanners, voiceprints, hand scanners, and facial recognition are examples of biometrics. something in your pocket is a security token, not biometrics. – Jasen Feb 1 '18 at 2:44
  • You can by definition of 2FA not have it implemented purely in software. (unless in software is a software on another device like a phone or hardware token, obviously) – Josef Feb 1 '18 at 11:12
3

I'm turning my previous comments into a proper answer

The solution to stopping account sharing within your company is to

Educate the user & Make registration convenient

No gimmick in the world will prevent your users from account sharing if they are not informed about it. No matter how strong the 2FA is coupled to the person. Requiring a DNA sample upon login just prompts people to keep a jar of spit besides their desk.

Educate their users and tell them why loss of audit trail is bad for them (and their coworkers).

If your registration is cumbersome then make it easier. For example instead of them sending you (the admin) an email maybe make a simple web form where they can register with their employee ID.
Lowering entry bounds is always good when it comes to stopping account sharing.


This answer has become obsolete after the question was edited

  • I believe you did not understand my problem. – Carlos Alves Feb 1 '18 at 2:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.