Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A friend of mine has the following problem. She is an accountant and her clients frequently give her their login credentials so she could download their accounting data from various financial institutions websites. Also she has a part-time employee who helps her with some routine tasks. My friend wants her employee to be able to download the clients' data without having to disclose her clients' login credentials.

Not unlike most of the commentators below I would also much prefer for everyone on the planet to have their own unique accounts for everything and never share. Unfortunately that is not the case. So please concentrate on the task at hand.

I am looking for a way to set up a local proxy server so it would automatically authorize the user's browser session at the remote web site with predefined credentials.

I need the credentials database to be stored on a server in the local network (not in the cloud and not on a user PC) so the solutions like various browser plugins would not work. The configuration should support multiple accounts at the same web site.

share|improve this question
    
Why prevent the part-time employee from knowing the credentials? Once the employee has access, why keep the password a secret? The password is to limit access, which you are already giving away. Hand out the password, and all the client needs to do is to change the password to prevent further access by the employee. –  schroeder Jun 18 '13 at 21:58
    
The main reason is to be able to revoke employee access without having the clients change their passwords. –  Alex P. Jun 18 '13 at 22:21
    
Also changing the password by the employee after logging in is not a concern. Most web applications they use have extra security measures in place to prevent just that (like having to answer security questions in order to change the password). –  Alex P. Jun 18 '13 at 22:29
2  
The employee and your friend should each have their own accounts, rather than using client's accounts... –  John Jun 19 '13 at 2:03
    
If the client is not hesitant to share the passwords he/she should also be willing to change passwords regularly –  Shurmajee Jun 19 '13 at 4:15
show 2 more comments

2 Answers

Well the problem started with your friend's clients giving her their credentials rather than creating a new account on their portals for her... That's bad.

Putting that aside there is one way to get the employee in without disclosing the password. You could use this chrome extension:

https://chrome.google.com/webstore/detail/edit-this-cookie/fngmhnnpilhplaeedifhccceomclgfbg?hl=en

and transfer the authentication cookie from the logged in computer, to the other employee's computer.

All of this is really sketchy, and flaky though. Sketchy because you're breaking so many security best practices, and flaky because you're setting yourself up for failure.

Bottom line: You need to be able to trust your employees. Maybe she can get the employee to sign some paperwork to make it possible to prosecute the employee, should he try to use the access to cause damage.

share|improve this answer
    
Paperwork does not prevent pilfering. –  schroeder Jun 19 '13 at 14:59
1  
@schroeder you're right. But trust is a human problem. You can't solve everything with technology. That's why they have non-disclosure agreements, and the like. –  John Jun 19 '13 at 15:56
add comment

There are lots of reasons not to do this but rather to obtain the client's data through more secure means. Putting that aside and addressing the asked question:

You COULD use the LastPass browser plug-in, which automatically logs you into a website, and hope that the part-time employee doesn't log into LastPass database to obtain the plaintext client password. That approach basically does what you describe, for free and without additional technology.

share|improve this answer
2  
You can share credentials via last pass without giving the share-ee view access to the password... However that user could always just change the password from within the system after logging on. However this method is not air-tight : enterprise.lastpass.com/enterprise-administration-basics/…;. –  BrianAdkins Jun 18 '13 at 22:02
    
An enterprise account used in this way would be better. You could simply remove the employee from the shared folder without needing to give the employee access to the central LastPass account. AGAIN: not a secure solution, but satisfies the conditions of the OP. –  schroeder Jun 19 '13 at 15:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.