Single portal login to access multiple customers

Hi,

you should usually be able to do something like rory.smith+customer1@domain ,  rory.smith+customer2@domain to manage credentials from a single e-mail address.  While it may also be useful to manage multiple customer setups from one e-mail, that is of course also a potential security issue.

Thanks Rory, we’ve been notified of that, but our IT block these as it’s essentially spoofing.

Interested to hear your thoughts on how it would be a security issue if you’re only assigned to the customers that you should have access to? I am not proposing that you can access a customer without being explicitly added as a user under each one.

Hi,

well it produces a single point of failure: one account can reach multiple customers with one credential. I would not want all my customers being affected by a credential leak instead of just one. Otherwise TimeXtender would need to decouple username from UPN / e-mail. I also prefer the current setup where I log in and only see that customer, as opposed to the potential of my customer noticing all the other customers I can log in to if they are looking at my screen.

Subaddressing is described in RFC 5233 and an official part of e-mail (see: https://datatracker.ietf.org/doc/html/rfc5233). There is no spoofing involved as you are not obfuscating origin or destination - I would be interested to know of any security problems associated as it is usually useful in tracking low-effort spam origins and e-mail leak origins. "Security considerations are discussed in [RFC5228]. It is believed that this extension does not introduce any additional security concerns.” is what the RFC itself states. The RFC linked simply states what implementations should do to avoid being exploitable.