271–280 of 297 posts
Earlier quoted context omitted.
Immediate example that comes to mind: there’s a paid-for Canva account that multiple people need to use. Can’t use separate logins because then you’d need multiple subscriptions.
This is in breach of the tos though, right? Great example to set for the kids.
Earlier quoted context omitted.
> And yes they are designed for businsses and have business customers. What I'm saying is that by definition these aren't designed for businesses. They might have business customers, they might even think that that's where their primary market is, but they're not designed for businesses if they use an account model that is designed for single consumer. And if they can't have been bothered to put together an account s…
I think your definition is too rigid and unrealistic. While this example is cherry picked, it’s practical and real world. A studio is working on a project for a client. They want to share the work with the client. Setting up individual client accounts is both impractical and unnecessary. They instead opt for a single password to protect the project. This password is stored and shared by the client.
In your example, what path forward makes sense would depend on the project, but "single shared password" would be unsatisfactory to me as a client.
We had this problem at my last job - ended up building our own system cause nothing really fit. Some tips from what we learned: 1. don't use shared spreadsheets or docs, way too easy to mess up 2. need granular access controls + audit logs 3. automate onboarding/offboarding as much as possible 4. rotate creds regularly, especially for sensitive stuff 5. use SSO where you can to minimize password sprawl There are some…
Earlier quoted context omitted.
> but at a minimum any service that wants business customers will have accounts in some form. I mean, that's just not true. Plenty of successful and widely used businesses out there provide a single account/password for their service at a client company, rather than for each human user at that client company. It's a common pattern even if you think it shouldn't be. And yes they are designed for businsses and have bus…
> And yes they are designed for businsses and have business customers. What I'm saying is that by definition these aren't designed for businesses. They might have business customers, they might even think that that's where their primary market is, but they're not designed for businesses if they use an account model that is designed for single consumer. And if they can't have been bothered to put together an account s…
Then why do you think there are all of these systems that don't have it? The CEO's/PM's aren't entirely stupid. They know what business customers are asking for, and what they're prioritizing in their asks, and how they're voting with their dollars.
An account system is often going to come with different roles like admin, user, viewer, and then the entire product has to be overhauled to create display-only versions of what were workspaces where changes could be made, new role authentication checks on every API call and even every data operation, and so forth. It can actually be a relatively huge undertaking that winds up touching a majority of the code, that also adds to the scope of most future feature development in a non-trivial way. It's not just a table of users and passwords per account.
I'm not saying it can't or shouldn't be done. I am saying that the idea that a companies without it "by definition aren't designed for businesses" is wrong, though. Not by definition, but by the reality of actual businesses today.
Earlier quoted context omitted.
You trust Proton with that data?
I certainly do, I have not seen anything yet that makes me reconsider. They have always answered to concerns well. They pass security audits. Sure I'd prefer a Linux Proton Drive client over a BTC wallet, but nobody's perfect.
Proton will pwn you if Interpol smiles at them the right way. This is common knowledge.
Lastly, of course like everyone said: SSO is your friend!
Earlier quoted context omitted.
I certainly do, I have not seen anything yet that makes me reconsider. They have always answered to concerns well. They pass security audits. Sure I'd prefer a Linux Proton Drive client over a BTC wallet, but nobody's perfect.
> I have not seen anything yet that makes me reconsider Proton will pwn you if Interpol smiles at them the right way. This is common knowledge.
Earlier quoted context omitted.
there is no way to word this question to be appropriate for stack exchange. it fundamentally does not belong on stack exchange
yes I can kind of see that, its not specific enough and almost a product recommendation ask. Normally the Security department handles this and we turn it over to them to make the policies and procedures.
Every employee has a collection. When employee needs access to something, we add that password to their collection.
When they leave the company, we revoke access to Bitwarden and then change all passwords in their collection.
For small companies of maybe up to 100 employees, this is a super cheap and practical solution.