27

Online joint accounts that are similar to bank accounts that are joint accounts?

Say you want to have two partners for a certain account, let's say a PayPal account, and you want to make it so that if one partner wants to change a password he must get confirmation from the second person.

Are there currently any online accounts that have a such a feature?

15
  • 13
    Joint bank accounts don't work that way. Each user have their own password and user id and even debit/credit card linked to the account if they exist. Depending on the type of account you may have "disjunctive" accounts, were each user can do everything, and "conjunctive" were each operation requires approval by all owners. So, do you mean a "conjunctive" online account for some service? Feb 10 '20 at 10:45
  • 6
    Link multiple accounts to the same source, don't share an account.
    – Mast
    Feb 10 '20 at 12:27
  • 2
    A bank account and a login account are two separate things. With online banking, one person could have a single login account that accesses multiple bank accounts, and multiple login accounts could access the same bank account.
    – barbecue
    Feb 10 '20 at 14:24
  • 2
    This is just another form of MFA, and is common in many highly secure situations, where multiple users are required to authenticate before an action is allowed to taken. Things such as firing nuclear strikes from the U.S. arsenal require separate codes from the President and the Secretary of Defense known only to them. I don't know if there are any public-facing services that utilize this level of authentication security, though. Most public-facing services are provided for individuals rather than organizations, and so follow the MFA route of one user authenticating multiple ways, instead.
    – TylerH
    Feb 10 '20 at 14:36
  • 2
    How would the first person be prevented from impersonating the second? Feb 10 '20 at 18:18
55

It's generally undesirable to have multiple people knowing the same password.

Instead, systems that requires multiple user to be able to access the same resources usually requires each user to create their own accounts, each with their own password that's only known to themselves, and the system would simply allow all the users to access the same resources. This means that a Joint Paypal account would have worked by allowing multiple user accounts to transact from the same wallet.

This means that it's unnecessary to get the approval of the other account holders to change password.

8
  • 9
    I think the OP was asking about a joint account where each users has their own credentials, and some consensus is required for some action. For example, multi signature cryptocurrency wallets. Feb 9 '20 at 21:12
  • 10
    @WilliamRosenbloom: If each user has their own credentials, why would one need to get the other's permission to change their password? Feb 9 '20 at 23:02
  • 9
    @BlueRaja-DannyPflughoeft The specific feature of needing agreement to change the password is nonsensical, for exactly the reason stated in this answer. But I think the OP was just using password reset as an example of an authenticated behavior, without realizing the paradox of that particular example. See my answer Feb 9 '20 at 23:18
  • 1
    @larry909 can you clarify this point? Feb 9 '20 at 23:21
  • 1
    @BlueRaja-DannyPflughoeft if not to change the password, --because each person has his own login-- to execute an action.
    – larry909
    Feb 10 '20 at 17:19
24

I don’t know of any actual web apps that employ such a system. But it is very much possible.

Specifically, what your asking about is called a threshold signature. The idea is that a group of N people each get their own secret credential. They can each use their credentials to partially sign a message. There will be some number M, often called the “quorum”, such that a complete (valid) signature is one in which at least M users contribute partial signatures.

More simply, M people out of a group of N members must sign a message for the signature to be valid. In a “2 of 3” (N = 3, M = 2) system, there are three people with credentials, and at least two of them would need to sign something to make it valid.

The only production use I know of is in cryptocurrency multi signature wallets. In most crypto currencies, money is sent by broadcasting a transfer message signed in such a way that proves ownership of the funds being transferred. In a multi signature wallet, no individual can unilaterally sign a transaction. Therefore no individual can unilaterally spend money.

In Monero and other CryptoNote coins, multi signature wallets also use ring signatures, so that the identities of the signatories within the group cannot be determined without the signatories’ secret keys. But signatories can create (safely shareable) proof of participation if they choose.

There is nothing to stop this kind of system from being used to authenticate a centralized web app such as a bank, but I have never seen it done. The common practice is to achieve a similar effect by privilege separation under trusted admins.

4
  • A related concept is "secret sharing", where you start off with one secret, but split it in a way that means you need M out of N shards to reconstruct it. Hashicorp's Vault uses this to "seal" a vault. Key signing ceremonies such as those used for DNSSEC sometimes also involve multiple shards of a key being physically brought together.
    – IMSoP
    Feb 10 '20 at 9:53
  • 1
    "Two out of two" is really simple, you just take two passwords p1 and p2, and instead of using hash (p1) to unlock the account, you take hash (p1 + p2). "n out of m", for example where either p1 or p2 (1 out of 2) unlocks the account, requires a bit of maths. The same maths can be used for any 1 ≤ n < m, for example "7 out of 11 passwords are needed to unlock the account".
    – gnasher729
    Feb 10 '20 at 11:00
  • 'One out of n' is often also easy to implement. You create a random master password mp and encrypt it twice to create E(mp, p1) and E(mp, p2). This setup is commonly used in whole-disk encryption, if only because it makes it easy to "change" the password p1. You just create a new password p2. There's no need to re-encrypt the whole harddisk as it remains encrypted with mp, not p1.
    – MSalters
    Feb 10 '20 at 15:14
  • 1
    This made me thinks of git web-apps (e.g. Gitea), in which one can set up a certain amount of “approvals” prior to be able to merge a pull-request. I don't know how easily this can be circumvented, but the principle of requiring multiple accounts approving an action before it can actually occur is there.
    – ebosi
    Feb 10 '20 at 17:32
4

Lastpass has a sharing feature which allows you to share a set of login credentials, without the other person being able to see the password.

This way you allow them to login with the username and password you share, they have no access to know or view that password, which precludes then from sharing it with anyone else.

The feature can only be used on a website where their auto-fill feature is compatible and when using their browser extension.

I am not aware of any security research done on this feature - as to whether it would be possible to extract the password from the extension if the other party were malicious, but if the use-case here is a friend or relative, this should provide sufficient protection.

Anecdotally, I know many married couples that use this to share logins, and this reduces the risk of password compromise if only one spouse's machine is compromised.

4
  • 23
    I would not trust that feature. Somehow the local browser extension has to know the password to be able to log in, and it would thus be a matter of firing up a debugger to find it. Lastpass even admits this themselves.
    – vidarlo
    Feb 9 '20 at 17:56
  • 4
    Also, the site doesn't know you're using a password manager to share a password, so either user can simply log in using the manager and manually change the site password to one not stored by the password manager, at any time.
    – notovny
    Feb 9 '20 at 19:05
  • I agree, although I made the assumption that OP was sharing the password with an already trusted partner. Feb 9 '20 at 19:27
  • @notovny Most sites require re-entering the existing password to change the password, so that particular attack is unlikely to work. Still not secure, although that's not all that important when used in the intended way. Feb 11 '20 at 17:31
4

Are there joint password account? (Like bank accounts)

No, this would be a very bad design.

Any provider which expects multiple individual to share the same resource shall provide :

  • A user account with dedicated credentials for each individual
  • A shared access to the resource for each user account

This prevent the need of password sharing, allow the possibility of user revocation and multiple level of permission.

This is already widely implemented in the B2B world when there can be multiple contact for the same company :

  • A bank joint account can be accessed by multiple users and each user can access a set of account (shared or not) from its own customer area
  • A web hosting provider usually defines a set of customer contacts (which dedicated credentials) and each user can access different ressources depending on their roles (owner, technical, billing, etc.).
  • A Facebook page is managed by one or multiples users with dedicated credentials
  • A Twitter account can now be managed by multiple users with different level of permission (publication, administration, etc.)

If you're in a business and need to share one access with one or more individuals and your provider doesn't support multiple user accounts, I'll suggest to find another provider before trying to find a secure password sharing method because there isn't any.

3

Most such services stay logged-in, so that a password is only needed to make account changes. In that case, you can simply have two people memorize half the password, or each type their own password in the same box, one after the other.

To change the password, or sign-in on a new device for the first time, both parties would need to be present to enter their half on the re-login screen.

Simple and effective and needs no software or vendor support.

2
  • Its a good idea, however some browser password managers allow the user to view the password, removing the need for the other persons consent
    – B-K
    Feb 10 '20 at 5:56
  • If both parties have to be present to log in, you could easily go a step further and require both parties to be present for all activity on the account, until logging out again. Then you can be reasonably confident that the combined parts of the password aren't being saved anywhere.
    – user3490
    Feb 10 '20 at 9:13
2

With a joint bank account, you have shared access, but not shared authentication. Specifically, each person will typically have their own access token (credit card/debit card), and credentials (pin number, online banking login), and shared online accounts will typically work in the same way, being able to grant other accounts access to the same resources.

For examples that I'm directly familiar with, you've got most of the Smart Home applications, where you can add users, and ever vary the level of access. Ring, for example, will allow you to allow a user access to specific cameras and resources, and similar things are available for services such as Tado or Phillips Hue.

Something that's a little closer to what you're looking at, you've got the households feature within iCloud accounts for Apple, where users can share subscriptions, have a single payment method, and even require authorisation for purchases from more senior users (parents, usually).

0

If you mean "single account, that can be accessed by different people using their each own passwords", I don't know about any widely available/actually in use shared PASSWORD systems. It can be easily achieved though on pretty much any POSIX system by setting same UID for separate user entries. Any service that depends on this authentication - like FTP or Telnet - will automatically inherit all those "shared" accounts.

If you use keys instead, then overwhelmingly common and known by pretty much everyone SSH allows you to associate unlimited number of separate keys with any user account. Once again, anything that runs over it - like, for example, SFTP or Git, will allow you to authenticate with any key.

0

I'm not an expert in security, but I'd like to put my two cents here.

Let's think on this example:

Bob and Alice have access to your system, and they can each perform certain actions without consulting each other. However, there are some actions for which both need to agree. Either Bob or Alice can request the action, but this will only be executed if both agree on it.
Example: To delete a row from a database table, both Bob and Alice must authorize the action.

Let's say that Bob wants to delete row 1 from the table. Bob access the system with his credentials and issue the transaction request. This transaction would be enqueued, awaiting for Alice to either authorize or deny this action. Later, Alice access the system with her credentials, and the first thing she sees is a notification: "Bob wants to delete row 1 from the database. Do you agree with this?". She could answer yes or no. If she answers "No", the transaction is cancelled, and if she answers "Yes", the transaction is executed.

Notice that this setup requires some things:

  1. User accounts (individual logins)
  2. Group accounts (groups of users)
  3. Transactions available for each user (which can be executed without any further authorization)
  4. Transactions available for each group (which need the authorization from all members of the group to be executed)

I've seen something close to this at my workplace: The HR administration system, which (among other things) we use to set goals for each year, has workflows that require that many users agree on certain operations. A user triggers an action, and another user (with higher privileges, or with the same privileges but in another branch of the hierarchy) must authorize this action (add a goal, remove a goal, edit a goal, etc.).

Notice that, at the end of the day, this setup is only as secure as the "weakest link in the chain", because once the last user of a group agrees on the action, it becomes irreversible. In our example, if Alice simply clicks "Yes" without reading the notification in full, the row in the table will be deleted and there may not be any rollback option.

1
  • What you describe is normal and a distributed authorization system for certain actions. Often called a "four eyes" control. That's not what is being asked for here, though. The specific thing being controlled is a password. The account factors themselves. Not a secondary thing like a database.
    – schroeder
    Feb 13 '20 at 23:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.