Schlomo Schapiro

Following up on Lifting the Curse of Static Credentials and Eliminating the Password of Shared Accounts , I have many discussions about why we would benefit from removing password prompts for website logins. Let's dig deeper into the details and show why removing password prompts leads to a  safer security architecture . Update 11.03.2022: Added more details about business vs. consumer websites and additional security suggestions surrounding WebAuthn Problem Space For context, imagine a website that needs to identify online users via their email address. We assume that the website in question is not the primary email system of a user but some other website, e.g. an e-commerce shop system or a collaborative productivity tool. As a User As a user of that website I want to easily sign up for an account have an easy way to login into the account be sure that my account is protected from others or attacks be able to easily recover access to my acco...

Following up on " Lifting the Curse of Static Credentials ", everybody should look closely at how they handle shared accounts, robot users or technical logins. Do you really rotate passwords, tokens and keys each time somebody who had access to the account leaves your team or the company? Do you know who has access? How do you know that they didn't pass on those credentials or put them in an unsafe place? Update : In May 2024 I gave a talk about this ( Video ,  Slides ): For all intents and purposes, a shared account is like anonymous access for your employees. If something bad happens, the perpetrator can point to the group and deny everything. As an employer you will find it nearly impossible to prove who actually used the password that was known to so many. Or even to prove that it was one of your own employees and not an outside attacker who "somehow" stole the credentials. Thanks to identity federation and federated login protocols like SAML2 and...

Summary:  Use digital identities, trust relationship and access control lists instead of passwords. In the cloud, this is really easy. I strongly believe that static credentials are one of the biggest hazards in modern IT environments. Most information security incidents are somehow related to lost or leaked or guessed static credentials, Instagram's Million Dollar Bug is just one very nice example. Static credentials can be used by anyone who has them - friend or foe are typically very short and can even be brute forced or guessed for machine or service users have to be stored in configuration files from where they can be leaked are hard to remember for humans so that they will write them down somewhere or store them in files typically stay the same over a long period of time don't include any information about the identity of the bearer or user are hard to rotate on a regular base because the change has to happen in several places at the same time All th...