Preventing Account Sharing
Discussion
To cut a long story short, we registered a fairly large company on our platform. They only bought 1 license (price per user strategy) as they were 'testing it before they buy more licenses'.
That was 5 months ago........
I visited their offices for a catch-up and noticed that they were using a shared PC amongst their entire company.
So I asked why?
And they said 'it's your pricing model'
We have procedures in place to log users out if two people log in with the same account. We run scripts to see how many accounts get accessed from various IPs and that has worked. But how do we prevent users sharing 1 PC?
Has anyone ever come across anything like this?
That was 5 months ago........
I visited their offices for a catch-up and noticed that they were using a shared PC amongst their entire company.
So I asked why?
And they said 'it's your pricing model'
We have procedures in place to log users out if two people log in with the same account. We run scripts to see how many accounts get accessed from various IPs and that has worked. But how do we prevent users sharing 1 PC?
Has anyone ever come across anything like this?
You need to give more details, there is no one size fits all solution it will typically involve a complete strategy involving your terms, your sales and your platform not a quick technical fix but it completely depends on your business.
But typically when deal with big business you don't cut them off unless they are costing you money, instead you warn them but continue to allow it then start to bill them what you think they should be paying.
Now obviously that requires clear terms and conditions defining what usage is allowed and what will happen if you are not in compliance, and have a way to detect it and that method will probably get fed back into writing your terms and conditions, but once you have your ducks in a row it becomes fairly easy to just bill for more, and at worse you don't get paid for a service you've already provided and weren't going to get paid for anyway. At best you get an upsell and a back payment.
But typically when deal with big business you don't cut them off unless they are costing you money, instead you warn them but continue to allow it then start to bill them what you think they should be paying.
Now obviously that requires clear terms and conditions defining what usage is allowed and what will happen if you are not in compliance, and have a way to detect it and that method will probably get fed back into writing your terms and conditions, but once you have your ducks in a row it becomes fairly easy to just bill for more, and at worse you don't get paid for a service you've already provided and weren't going to get paid for anyway. At best you get an upsell and a back payment.
b
hstewie said:
hstewie said: You don't do it technically, you need to enforce your EULA.
Or change your pricing.
We have written in our License Agreement, but how could we possibly check? We have users abroad and we can't turn up to their offices and physically check.Or change your pricing.
We really don't want to change our pricing unless we have to.
CasioPasio said:
bhstewie said:
hstewie said: You don't do it technically, you need to enforce your EULA.
Or change your pricing.
We have written in our License Agreement, but how could we possibly check? We have users abroad and we can't turn up to their offices and physically check.Or change your pricing.
We really don't want to change our pricing unless we have to.
There isn't a technical solution for this just as you just posted as CasioPasio but there's no way at all to stop your wife/child/mate posting as you if they simply walk up to your computer whilst logged into Pistonheads as you.
You have a legal problem not a technical one.
I have no experience in this area at all (!) but it's an interesting conundrum.
This surely must be faced by many companies who have a 'per user' license model - how do you stop a company having a central PC just to access the service to save on user licenses?
I would be interested to hear how it could be solved.
This surely must be faced by many companies who have a 'per user' license model - how do you stop a company having a central PC just to access the service to save on user licenses?
I would be interested to hear how it could be solved.
CasioPasio said:
We have written in our License Agreement, but how could we possibly check? We have users abroad and we can't turn up to their offices and physically check.
We really don't want to change our pricing unless we have to.
What have you gotten written into your terms and conditions? How can anyone know how to detect it if you haven't told them what is required and/or forbidden We really don't want to change our pricing unless we have to.
What data is in the system? If there is personal identifiable data in there they are probably breaking some GDPR regulation, find which parts they are in breach of and point this out to them (senior management not the grunts on the ground). If this doesn't make them tighten up who has access to what then your company has no chance in making them change.
bhstewie said:
hstewie said: You can't just as Microsoft can't, but if they find out you're breaking it they can take you to the cleaners.
There isn't a technical solution for this just as you just posted as CasioPasio but there's no way at all to stop your wife/child/mate posting as you if they simply walk up to your computer whilst logged into Pistonheads as you.
You have a legal problem not a technical one.
Yeah, I couldn't agree more. From a technical point of view, we've secured everything but we need to gather more legal resources to nail people if they break the terms in the EULA.There isn't a technical solution for this just as you just posted as CasioPasio but there's no way at all to stop your wife/child/mate posting as you if they simply walk up to your computer whilst logged into Pistonheads as you.
You have a legal problem not a technical one.
ging84 said:
What have you gotten written into your terms and conditions? How can anyone know how to detect it if you haven't told them what is required and/or forbidden
We've lightly covered not sharing accounts, logins etc which we can run scripts to check numbers of IPs accessing 1 account. But you're right, we probably should place more limitations and highlight it in bold.
jjones said:
What data is in the system? If there is personal identifiable data in there they are probably breaking some GDPR regulation, find which parts they are in breach of and point this out to them (senior management not the grunts on the ground). If this doesn't make them tighten up who has access to what then your company has no chance in making them change.
Lots and Lots of CRM data.We can easily pivot to change our integrations to ensure that we are pulling and writing data for a specific user with a unique ID.
But good shout on the GDPR. I reckon we could certainly share some of the bigger companies with that.
Sending a few invoices to the CFO with the 'right' number of users using the software would be a good idea as well!
Can't help with how to technically stop it.
But, does your license define 'user'? Is it one person, one user account, one IP, one MAC address, one PC?
Maybe the company's view is that there's only one 'user' account using the service - as they're only using a single log-in, from a single PC?
We've done it in the past where 2 job-share PAs needed to access the same travel booking system - which was also 'per user' - but they just logged in using a shared user account each time. The company didn't seem to believe they'd need 2 'full' licenses for 2 'part time' employees, as they'd only use it for the same amount of time as 1 full-time employee (although the FTEs did have their own licenses in this instance).
But, does your license define 'user'? Is it one person, one user account, one IP, one MAC address, one PC?
Maybe the company's view is that there's only one 'user' account using the service - as they're only using a single log-in, from a single PC?
We've done it in the past where 2 job-share PAs needed to access the same travel booking system - which was also 'per user' - but they just logged in using a shared user account each time. The company didn't seem to believe they'd need 2 'full' licenses for 2 'part time' employees, as they'd only use it for the same amount of time as 1 full-time employee (although the FTEs did have their own licenses in this instance).
How many people are accessing this shared PC at the same time & how is access being made by each person? If it's only one at a time then have they actually breached the terms.
It would seem you need to implement a method of preventing shared access though as you will never be able to actually go to site & see whether your clients are sharing or not & you probably don't have the funds to persue legal routes in multiple countries, unlike Microsoft.
It would seem you need to implement a method of preventing shared access though as you will never be able to actually go to site & see whether your clients are sharing or not & you probably don't have the funds to persue legal routes in multiple countries, unlike Microsoft.
mmm-five said:
Can't help with how to technically stop it.
But, does your license define 'user'? Is it one person, one user account, one IP, one MAC address, one PC?
Maybe the company's view is that there's only one 'user' account using the service - as they're only using a single log-in, from a single PC?
We've done it in the past where 2 job-share PAs needed to access the same travel booking system - which was also 'per user' - but they just logged in using a shared user account each time. The company didn't seem to believe they'd need 2 'full' licenses for 2 'part time' employees, as they'd only use it for the same amount of time as 1 full-time employee (although the FTEs did have their own licenses in this instance).
This is a company of 200+ people using 1 license.But, does your license define 'user'? Is it one person, one user account, one IP, one MAC address, one PC?
Maybe the company's view is that there's only one 'user' account using the service - as they're only using a single log-in, from a single PC?
We've done it in the past where 2 job-share PAs needed to access the same travel booking system - which was also 'per user' - but they just logged in using a shared user account each time. The company didn't seem to believe they'd need 2 'full' licenses for 2 'part time' employees, as they'd only use it for the same amount of time as 1 full-time employee (although the FTEs did have their own licenses in this instance).
A user in our terms is a 'unique individual user of our services'.
But can they use any other company for what you provide to them?
They arent going to buy 200+ licences for a program they don't all use religiously. Is one licence with them better than no licence at all, or is it no skin off your nose?
There is no way you have 200+ people queueing/waiting to use one PC on a daily basis.
They arent going to buy 200+ licences for a program they don't all use religiously. Is one licence with them better than no licence at all, or is it no skin off your nose?
There is no way you have 200+ people queueing/waiting to use one PC on a daily basis.
CasioPasio said:
mmm-five said:
Can't help with how to technically stop it.
But, does your license define 'user'? Is it one person, one user account, one IP, one MAC address, one PC?
Maybe the company's view is that there's only one 'user' account using the service - as they're only using a single log-in, from a single PC?
We've done it in the past where 2 job-share PAs needed to access the same travel booking system - which was also 'per user' - but they just logged in using a shared user account each time. The company didn't seem to believe they'd need 2 'full' licenses for 2 'part time' employees, as they'd only use it for the same amount of time as 1 full-time employee (although the FTEs did have their own licenses in this instance).
This is a company of 200+ people using 1 license.But, does your license define 'user'? Is it one person, one user account, one IP, one MAC address, one PC?
Maybe the company's view is that there's only one 'user' account using the service - as they're only using a single log-in, from a single PC?
We've done it in the past where 2 job-share PAs needed to access the same travel booking system - which was also 'per user' - but they just logged in using a shared user account each time. The company didn't seem to believe they'd need 2 'full' licenses for 2 'part time' employees, as they'd only use it for the same amount of time as 1 full-time employee (although the FTEs did have their own licenses in this instance).
A user in our terms is a 'unique individual user of our services'.
You’d need to check your contract in detail, then send them notice that you believe they are in breach of your licence model as multiple people are using the same account, which certainly isn’t in the spirit of your licence and (if well written) won’t be compliant with the letter of it either.
If you’ve got a concurrent user model, they’re in the clear - only one user is using it at a time...
I presume these users aren't using the software concurrently?
Do they physically use the machine it is installed on, or using a virtual session?
If it is being used concurrently, you need to code your software to only allow a single session at a time. If being used remotely you can detect this and code your software to disallow its use on a remote session.
I gather all 200 people aren't queuing up to have their turn on the software? What's the frequency of use? You need to be pragmatic here, if it is something that is used infrequently and even the use across 200 people wouldn't add up to more than 1 person using it normally then you don't have a strong moral case for pursuing and you should possibly consider if you are on the correct license type - consider a pricier corporate/system wide license instead?
However if this is a blatant case of it being used continually and way more than 1 person would be expected to use it then you should lawyer up - customers like that will never pay a fair price.
As a final punt - could you move to a model where the user has to login with a google or other personally attached account with an external provider which the individuals would be unwilling to share.
Do they physically use the machine it is installed on, or using a virtual session?
If it is being used concurrently, you need to code your software to only allow a single session at a time. If being used remotely you can detect this and code your software to disallow its use on a remote session.
I gather all 200 people aren't queuing up to have their turn on the software? What's the frequency of use? You need to be pragmatic here, if it is something that is used infrequently and even the use across 200 people wouldn't add up to more than 1 person using it normally then you don't have a strong moral case for pursuing and you should possibly consider if you are on the correct license type - consider a pricier corporate/system wide license instead?
However if this is a blatant case of it being used continually and way more than 1 person would be expected to use it then you should lawyer up - customers like that will never pay a fair price.
As a final punt - could you move to a model where the user has to login with a google or other personally attached account with an external provider which the individuals would be unwilling to share.
Edited by Order66 on Sunday 31st March 19:14
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff