Prevent Sharing of Login Credentials

[john w]

Does anyone have a suggestion for a way to restrict the sharing of login credentials?

I need the app to limit credentials to one user and restrict sharing. Suggestions, ideas, samples are appreciated.

Thanks,
John W

[ljwilson]

I'm sure Netflix would be interested in that as well!

I think the best you can do with a web app is limit logins for a user account to one at a time. You could also couple that with forcing them to get a new login "code" each day by sending a link to their email address for verification (2FA i.e. 2-Factor Authentication).

...jack

[info@maxsoftware.it]

I agree with the Jack on the one login at a time. You can setup a timer to check on regular intervals if the session is active.
2FA might get onthe end-user's nerves though...

You can also add device limits. for example: max 5 devices within the same month.

[john w]

Any suggestions on how to design the checking of person being logged in? I will guess I need to create a method to track that.

I agree about 2Factor being annoying.

[info@maxsoftware.it]

You can have a table where you write the user, hardware id if needed, and datetime of the login.
For every successful login, you insert/update the datetime of the user and activate a session timer with an interval of your choice.
Every time the timer hits 0, update the datetime and reset the timer.
Whenever you need to check the status, you check if the user's datetime falls within the time interval you set for the timer or not.

[john w]

Great suggestion and thanks! It gives me a path and ideas I can use to create a solution.

[info@maxsoftware.it]

Glad it helps. Banged my head against the wall plenty of time in the past for solutions...

[Ted Giles]

Not sure if this works with InDe, but in Alpha Desktop, I have a process which captures data about the machine the first time someone signs up for an app. That is built into the login credentials so anyone else cannot use the app on a different machine.
It was created to prevent Lift and Shift.
You could save that data I suspect.
Or, I remember something about Cookies which means you don't have to log in?

[john w]

Thanks for all the ideas. Now I just have be convinced it needs to be done.

[Ted Giles]

Ah!
If the client want to spend $50, probably not essential.
But for $1000, it would definitely be "essential "