@serge@babka.social I’ve seen this solved in different places already. Commercial example is GoDaddy, with ‘log in as’ your customer. I have seen this implemented in Government too, which has a similar approach to the commercial example. They mention “Never share your login details for the Netherlands Tax Administration with anyone. Instead, you can authorise the person filing your tax returns. They will then log in with their own details.” Both approaches implement a TTL. 😄

Another approach would be if Alice could generate multiple Passkeys and hand them out to individuals she trusts, and then retaining the ability to revoke them. Sadly many sites don't yet support Passkeys, and this model still lets someone like Mal revoke Alice's access, so that's not great.

Bitwarden has a feature whereby Alice can share a password with Eve but not let her see it or export it. This could work pretty well, except that if the site requires 2FA from a SMS text message (vs TOTP or a token) or if Eve has the knowhow to intercept the password.

I still think that what we ultimately want is attenuated scopes because then we can track all actions by the delegated party.

I do wonder if this need is niche or if the current solution of "good faith password sharing" works well enough often enough that it's not risen to the level of concern for developers.

2/2

#Authentication #Authorization #InfoSec #Passwords #Passwordless #Programming

@lbnvds@mastodon.social Thanks!

@davep@fosstodon.org Neat!

All 7 TCL users feel extremely vindicated.