New answers tagged

0

Never enter your "work", or "personal" login information into anything but those portals for which they were created. Always use different usernames, and passwords for each separate account you create for each separate website that requires it. If this website is asking you to create an account, that seems normal, if they are asking for other information, ...


0

I'm not an expert in security, but I'd like to put my two cents here. Let's think on this example: Bob and Alice have access to your system, and they can each perform certain actions without consulting each other. However, there are some actions for which both need to agree. Either Bob or Alice can request the action, but this will only be executed if ...


0

If you mean "single account, that can be accessed by different people using their each own passwords", I don't know about any widely available/actually in use shared PASSWORD systems. It can be easily achieved though on pretty much any POSIX system by setting same UID for separate user entries. Any service that depends on this authentication - like FTP or ...


1

Password Policies A password policy cannot be created in a vacuum, it must be derived from the Security Policy & Process of the Organization. Usually, this is called the ISMS, or Information Security Management System. In the general case, it will consist of a variety of policy documents addressing different aspects of information security. For ...


1

Let me try to answer this question. In general, it is the role of the business owners to have up to date inventory of all assets, to decide on critical assets and to prioritize the importance of before any further business impact analysis and action related to security (confidentiality, integrity, accessibility) happens. One could classify assets and data ...


2

With a joint bank account, you have shared access, but not shared authentication. Specifically, each person will typically have their own access token (credit card/debit card), and credentials (pin number, online banking login), and shared online accounts will typically work in the same way, being able to grant other accounts access to the same resources. ...


4

Are there joint password account? (Like bank accounts) No, this would be a very bad design. Any provider which expects multiple individual to share the same resource shall provide : A user account with dedicated credentials for each individual A shared access to the resource for each user account This prevent the need of password sharing, allow the ...


24

I don’t know of any actual web apps that employ such a system. But it is very much possible. Specifically, what your asking about is called a threshold signature. The idea is that a group of N people each get their own secret credential. They can each use their credentials to partially sign a message. There will be some number M, often called the “quorum”, ...


3

Most such services stay logged-in, so that a password is only needed to make account changes. In that case, you can simply have two people memorize half the password, or each type their own password in the same box, one after the other. To change the password, or sign-in on a new device for the first time, both parties would need to be present to enter ...


4

Lastpass has a sharing feature which allows you to share a set of login credentials, without the other person being able to see the password. This way you allow them to login with the username and password you share, they have no access to know or view that password, which precludes then from sharing it with anyone else. The feature can only be used on a ...


55

It's generally undesirable to have multiple people knowing the same password. Instead, systems that requires multiple user to be able to access the same resources usually requires each user to create their own accounts, each with their own password that's only known to themselves, and the system would simply allow all the users to access the same resources. ...


-1

The criteria I use for passwords is this: Be generated by the website itself, so users cannot use insecure passwords by design. Be computer generated, so its pattern is truly chaotic. Human generated passwords have predictable patterns. Be made only of lowercase letters, so it's memorable and fast enough to type on any kind of device and keyboard. Be 20 ...


Top 50 recent answers are included