I am trying to build correlation/ potential red flag rules to detect if passwords are being shared or stolen... the primary driver for this is guidance from our compliance team, that much of our frauds in payments have arisen because of deliberate sharing or theft of a co-workers credentials (e.g. in maker checker etc). I was asked to look at a data-centric approach to solve this

some thoughts include a) password being used at 2 IP addresses that area physically far from each other b) software application being accessed without physical access swipe record (that would indicate entry into work area)

Any thoughts/ guidance around how to build a comprehensive list of flagging suspects here

  • 2
    Do you actually want to identify password sharing, or do you effectively want to prevent it? Using multifactor authentication, e.g. a hardware token, you can prevent someone only knowing the password from using your service. Smartcards and hardware tokens would be an example for this kind of security. – Karol Babioch Mar 19 '14 at 18:41
  • 1
    @raghu Please consider clarifying your question with some more detail on the root problem. Are you talking about two different user's using the same password or are you talking about people sharing the actual account? What is the swipe record specifically referencing here? Also, what is the relevancy of the IPs being far? Are you trying to just block bots with the same password being used for attacker's convenience? – Eric G Mar 19 '14 at 22:13
  • Thanks for the inputs. I have tried to clarify- hope that helps – raghu Mar 20 '14 at 13:28
  • Nope, still not clear; do your users login with both an id (email, employee number, whatever) and a password? Or only a "password"? On password-only systems, generating new passwords is problematic (ie, you have to lock both accounts if a collision is detected). On systems with both (user-id and password), you're 1) essentially lengthening the secret key and 2) have additional info for tracking/etc. In the case of having both, it doesn't matter if 2 accounts share passwords... – Clockwork-Muse Mar 20 '14 at 14:08
  • Ok, so you are talking about account compromise - someone else using another person's username and password? You should update your post and title to reference this as password sharing in the context of your question is still ambiguous – Eric G Mar 20 '14 at 17:35

I believe you are concerned with multiple people reusing a shared identity, not just the specific case of shared passwords. If you are using some kind of persistent session, you can close the one session when the next one signs on. You can consider a GeoIP solution to see if your users could have traveled to the new location in the amount of time between the prior logout and the current login, but know that GeoIP systems aren't perfect.

Instead of automatically enforcing an error, you are probably better off defining an acceptable use policy, and telling your users "don't share passwords, don't leave yourself logged in", that sort of thing. Use timing data to enforce the policy.

  • tried to clarify- really trying to prevent fraud (sharing typically starts on expedient reasons) – raghu Mar 20 '14 at 13:30
  • I'd look at the problem and figure out if you can live with detecting fraud and punishing violators. It's much simpler and cheaper to detect it after the fact than it is to build a whole system to try to prevent it, but your risks of loss might offset the cost. That's a decision you would have to make. – John Deters Mar 21 '14 at 3:07

Valve's Steam will only let you to log on to your account from computers and locations that are registered and allowed. If you try to log on from a different computer or location, you will receive and have to confirm an email allowing it first.

I think it is pretty functional and reasonably safe in the sense that a Steam user would have to lose both its Steam account and its Email account in order to be stolen.

Naturally it also prevents you from logging in to your account from multiple places at once.

Perhaps you can do something like that too, and impose limits like "you can only have 2 different access points registered" to prevent this user from registering family and friends and whatever (not sure whats your goal). So even if he shares his account, it would be in a controlled and acceptable scope.

  • The question then becomes in which way devices or computers get registered and how tamper resistant such a scheme is. As all of this seems to be based purely on software, it probably can be cloned, i.e. shared. – Karol Babioch Mar 19 '14 at 19:08
  • Piracy has proven that there is nothing completely share proof, but how viable is it to share? Even a Cookie can be acceptably safe if something enforces that it is only valid if coming from a specific IP. – Havenard Mar 19 '14 at 19:13
  • Yes, this is precisely my point. You can't build a "cloneproof" system with pure software. Hardware tokens on the other side are usually tamper resistant. Obviously it doesn't mean that it would be impossible to get the keys out of such a token, but if implemented correctly it becomes a notorious task. – Karol Babioch Mar 19 '14 at 19:26
  • It is an option, but its an expensive one. Afaik only banks use it, and optionally Blizzard Entertainment if you pay for the pricey token. We don't even know what he wants, but whatever it is, using tokens is probably not a viable solution. – Havenard Mar 19 '14 at 19:33

You may want to consider other ways of deterring that behavior. Detection could be difficult or unreliable.

If users had some motivation to keep their account private, even from friends or close coworkers they would self-police, solving your problem.

Policy is one option, people who are found to be sharing passwords can be punished or fired or their accounts suspended.

Another option is to have sensitive information or actions attached to that account. I wouldn't share my iTunes account with my friend if he had the ability to delete my collection.

  • If the motivation to share exceeded the motivation not to share, then your scheme fails. How would you detect if sharing was happening in order to enforce policy? If it is a work account, then your last point won't work because the point is to share access and authority. – schroeder Mar 19 '14 at 22:38
  • Interesting points. I'm not claiming my alternative methods are perfect. Policy + enforcements aren't going to catch every case of sharing but if you fire or discipline one person, it may encourage others to behave. – u2702 Mar 20 '14 at 23:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.