If using a different password for every application is considered good practice, why is using a directory so widespread?

Question

The title pretty much sums it all. We are always told that we should use a different password for every site and application, so that if one of those accounts is compromised, the others will still be safe.

Why is it then that using a directory, especially in enterprise environments, is considered normal practice and is also recommended?

I understand the obvious convenience of centralized user management, but isn't this clashing with the multiple passwords rule after all?

Answer 1

It is true that if your password is compromised, your access to all other systems in the directory goes with it. However, there are other differences that make the practise of password reuse a completely different ball game:

• Directory: Once the breach has been reported, the account can be disabled or the password changed from a central location.
• Separate applications: The account would need to be disabled or the password changed per application.
• Directory: The breach will not be spread out over systems controlled by different entities - You would just usually need to contact your sysadmin.
• Separate applications: You would need to contact potentially hundreds of different companies in order to regain control of your accounts with potential for accounts to be missed.
• Directory: Any password guessing attacks over different systems in the directory would most likely to be detected.
• Separate applications: If it is known that you possibly use the same password over different accounts, then an attacker could split their attack and try different word lists against different systems undetected until they gain entry.