<story><title>Password expiration is dead, long live passwords</title><url>https://techcrunch.com/2019/06/02/password-expiration-is-dead-long-live-your-passwords/</url></story><parent_chain><item><author>mattowen_uk</author><text>Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords.&lt;p&gt;A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the &amp;#x27;account&amp;#x27; and build the basket. Maybe the other will then amend the basket a few hours later before the cut off time. With enforced MFA, this is not possible.&lt;p&gt;There will always be a small percentage of situations where &amp;#x27;1 person = 1 account&amp;#x27; will never be true. Until providers add the concept of multi-logins to the same &amp;#x27;account&amp;#x27; on their systems you can&amp;#x27;t wholesale move to stronger security methods.&lt;p&gt;I have the same issue with all these &amp;#x27;smart home&amp;#x27; products that need an app installed onto a phone or tablet. A lot of them are bound to a single account, which means if other people in the household also want to have the app, you have to share your account details. if it&amp;#x27;s a Google or Amazon product, that means you are sharing account details of an account that you really shouldn&amp;#x27;t be.</text></item></parent_chain><comment><author>faceplanted</author><text>YouTube has this problem to an insane degree, some large businesses are run from a single person&amp;#x27;s long standing Google account and there&amp;#x27;s no way to give another YouTube account any privileges you might want an employee to have without giving them access to your entire Google account and all attached services including your emails, the ability to locate and wipe your phone, all the photos on your phone via Google photos, your calendar for it&amp;#x27;s entire history, I could go on.&lt;p&gt;It&amp;#x27;s completely insane, and the closest they&amp;#x27;ve gotten to adding anything like this is letting people have comment moderators on live streams, not videos where people have wanted comment moderators from day one, just live streams.</text></comment>
<story><title>Password expiration is dead, long live passwords</title><url>https://techcrunch.com/2019/06/02/password-expiration-is-dead-long-live-your-passwords/</url></story><parent_chain><item><author>mattowen_uk</author><text>Shifting from passwords to more secure systems such as MFA ignores the elephant in the room about passwords that no-one wants to acknowledge: People share passwords.&lt;p&gt;A simple example is this: A couple do online grocery shopping every week or so, depending who has time to do it, one them will log into the &amp;#x27;account&amp;#x27; and build the basket. Maybe the other will then amend the basket a few hours later before the cut off time. With enforced MFA, this is not possible.&lt;p&gt;There will always be a small percentage of situations where &amp;#x27;1 person = 1 account&amp;#x27; will never be true. Until providers add the concept of multi-logins to the same &amp;#x27;account&amp;#x27; on their systems you can&amp;#x27;t wholesale move to stronger security methods.&lt;p&gt;I have the same issue with all these &amp;#x27;smart home&amp;#x27; products that need an app installed onto a phone or tablet. A lot of them are bound to a single account, which means if other people in the household also want to have the app, you have to share your account details. if it&amp;#x27;s a Google or Amazon product, that means you are sharing account details of an account that you really shouldn&amp;#x27;t be.</text></item></parent_chain><comment><author>Sahhaese</author><text>I agree sharing passwords is a really common thing, even among corporate &amp;#x2F; enterprise SaaS. Even with MFA people share dongles &amp;#x2F; code pads.&lt;p&gt;But the correct pattern is a formal system for delegation and&amp;#x2F;or disconnecting &amp;#x27;login&amp;#x27; with &amp;#x27;account&amp;#x27; (i.e. separate charging for a service from the login). This is something that AWS does very well for example.</text></comment>