Access

Access and passwords in a team, by Ilia Zavialov

Access is not a password. It is the answer to who, right now, can act in the name of the company. If that answer cannot be read from a table, it does not exist.

English version for the United States.

The access list as a single document

A table of four columns: person, service, role, date issued. A fifth column names who approved it. Nothing more is needed, and less does not work.

The value of the table is not tidiness. It is that the answer arrives in seconds at the moment access has to be closed quickly.

Separate accounts instead of a shared one

A shared account means an action cannot be tied to a person, and changing the password breaks work for everybody at once. So a shared password holds exactly until something happens.

Separate accounts with roles cost the same or slightly more in most services, and that difference is smaller than one hour spent unpicking an incident.

A password manager as shared storage

The manager is needed not for password complexity but for handover: access is granted and revoked in one place, and after revocation the person genuinely loses it.

A password passed in a messenger is never revoked: it stays in the history and on the device.

The second factor and what is wrong with SMS

An SMS code is intercepted through a SIM swap and is typed by the victim on a fake page. It is a second factor, but the weakest available.

An authenticator app is better; a hardware key is best, because it cannot be phished out of you: it checks the address of the site itself.

Rules of this section

One line, one accessPerson, service, role, date, who approved.
No shared accountsAn action has to belong to a person.
Handover through storageNot through a messenger and not through email.
Second factor by priorityKey, then app, SMS last.
Backup codes apartPrinted, away from the phone and away from the vault.

Second factor methods and what each one saves you from
Method	Saves from	Does not save from
SMS code	Simple password guessing	SIM swap, a fake page
Authenticator app	SIM swap	Entering the code on a fake page
Hardware key	Fake pages, code interception	Confirming a malicious action
Backup codes	Losing the phone	Being stored next to the phone

The point. A hardware key checks the address of the site by itself, so a fake page cannot obtain a confirmation from it. It is the only one of the four that closes phishing structurally rather than relying on attention.

Questions and answers

How much does it cost to put access in order?

The access list costs one evening. A password manager for a small team costs less than one hour of an administrator's time per month.

Can a table replace a password manager?

They solve different problems. The table answers who has what; the vault lets you grant and revoke access so that revocation actually takes effect.