Hacker News new | ask | show | jobs
by daigoba66 4642 days ago
You should first ask yourself why you have the shared password at all. Unless there is simply no other way, shared passwords and logins should be avoided for the obvious reasons.

Next you need to document the procedure for resetting each of these passwords and accounts when an employee with access is fired or quits. Resetting the password needs to happen the minute the employee leaves the building.

As for documenting the password itself, the best approach is a shared document or file with built-in access control and auditing so you can tell exactly who has seen this document (for instance, google docs. Or an "enterprise" wiki).

While you can't use technology to prevent it, there should be a policy that employees cannot distribute these passwords, period. This is why having the password reset procedure is so important.

2 comments

There are plenty of necessary sites that just don't let you have multiple accounts for management. I can think of a few but there are tons more - ebay and PayPal are the first two that come to mind. You also get into "concurrent licensing" issues - lots of companies make you pay for each "person" you have tied to the account (like an infrequently used fax number). Account sharing is a necessary evil - but the other comments you mentioned are dead on.
rackspace, for example, doesn't support multiple user accounts.
For what? All the members of our team have a Rackspace login. We can all make tickets, reboot servers, etc.
We've only just found the user management link in account settings, how long has this been available?
A while - I added someone last year IIRC.