1

To simplify the user experience , if we want to design a system such that the user login password for the desktop account itself can be shared with various applications like chat/email/skype etc.

How do we pass credentials across applications without asking the user to give them again / seperately? I understand it's not safe and can cause a single point of failure. But I am curious about the technology for credential sharing across applications than single point of failure stuff .

|improve this question
  • What is your threat model ? – Stephane Jan 14 '14 at 16:37
  • how to define one ? – sashank Jan 14 '14 at 16:42
  • The simplest way to do it is to define what your system is, what is exposed to an attacker, who your attackers are, what they can do to compromise your system, and figure out what needs to be protected from there on. – Karthik Rangarajan Jan 14 '14 at 17:02
  • Also, I don't think there are easy (or hard, for that matter) ways to do what you're looking for. Skype, chat, email, etc. are far too diverse, and use their own forms of authentication, and I don't think you can use a desktop password to automatically log into these accounts, in a secure or insecure way. – Karthik Rangarajan Jan 14 '14 at 17:04
  • 2
    Why not use old well tried solution for access control: Kerberos. It had enterprise security like things, including passing credentials or ticket granting tickets around for ages. – user4982 Jan 14 '14 at 18:00
3

If you want something centrally managed across an enterprise domain (i.e. federated identity), then you'll want to look into some sort of solution mentioned on this Wikipedia article. Identity management is complex, time consuming, and will take a lot of engineering and administrative resources - especially if your users have access to multiple information systems across your enterprise.

If your environment or user base is smaller, or you don't care about centrally managing credentials or a federated identity, you can look into a utility like LastPass for Applications

|improve this answer
  • I don't think he is asking for password managers, but more of a system that logs in to everything using a desktop account. Which wouldn't be possible using federated identity OR LastPass. – Karthik Rangarajan Jan 14 '14 at 17:09
  • If you're dealing with something that is technology centric (i.e. a Microsoft OS, Skype [owned by Microsoft], and Active Directory [a Microsoft technology], etc...) then you can integrate it all naturally in Windows 8 (windows.microsoft.com/en-us/windows-8/…). I'm pretty sure you can do something similar in earlier versions of Windows (windows.microsoft.com/en-us/windows7/…). – genesys Jan 14 '14 at 17:23
  • 1
    Yeah, if it is all Microsoft technology, then I can see how you could just use NT credentials for the whole thing. although I am not sure if Skype supports AD authentication yet. Still a tricky setup though. – Karthik Rangarajan Jan 14 '14 at 17:28
  • If you start binding you AD/local credentials with a MS account, I'm pretty sure the process becomes "seamless" (in a relative sense), but TBH, i've not tried. See the first link in my first reply. But in the end, once we start speaking about AD in the context of managing credentials across disparate information systems or applications... we're now on the path to speaking about federated identity. en.wikipedia.org/wiki/Federated_identity – genesys Jan 14 '14 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.