Over-complicated granting makes owners share the master account

What it is

When the legitimate path to grant access — both parties present, app download, account registration, invite, acceptance, permission configuration — is too cumbersome, owners skip it and hand over the master account password instead. That single workaround zeroes out the entire permission system: the "guest" becomes a full administrator wearing the owner's identity, with access management, camera playback, and purchasing power all transferred along with the password.

This is a classic security failure shape: when the legitimate path costs more than the workaround, the workaround becomes the de facto main path. It is not users being uncooperative — the design made cooperation the most expensive route.

Why it happens

Costs and benefits misalign on the time axis. The legitimate flow's costs are paid now: five to ten minutes, both people present at once, the other person installing an app she never wanted. Its benefits appear later, and in the form of nothing happening — scoped, individually revocable, attributable access only becomes perceptible when something goes wrong. The workaround costs zero now. At the granting moment the comparison is "ten minutes of hassle" versus "nothing", and the outcome is not in doubt.

The consequences then cascade. A shared master credential means: no attribution (every action logs as "the owner"); no per-person revocation (changing the password kicks everyone off including oneself, so it never changes); and the password enters the household's oral circulation — on the fridge note, in the family group chat — spreading beyond any traceable range. One workaround dismantles all three pillars of the permission system (scope, revocation, attribution) simultaneously.

Norm erosion compounds it: the streaming era trained households to treat account sharing as normal courtesy, and that expectation carries into smart homes — where the account fronts locks and cameras, a wholly different semantic that the user's account intuition never updated to match.

Studying it

• Security-practice interviews: Zeng, Mare and Roesner's interviews with smart-home households (SOUPS 2017) found that residents rarely used the access-control features available to them and that informal credential sharing was the norm — handing over the password was the path of least resistance when family members or helpers needed access. That gives the "frustration drives workaround" pattern its empirical base in domestic settings.
• Telemetry comparisons: in deployment data, plot two curves — formal guest/secondary account creations versus logins of the same master account across multiple unmanaged devices. The latter running persistently above the former means the workaround is winning; the ratio is a direct "flow competitiveness" indicator.
• Flow-cost audits: decompose and time the legitimate grant path step by step (download, register, verify, invite, accept, configure) against the twenty seconds of "telling them the password". This static comparison forecasts the outcome without any user study.

One methodological caution: asking "would you share your password?" in interviews invites social-desirability bias (nobody admits it); asking for concrete event recall — "your friend stayed last month; how did you let her in?" — recovers the real path.

Where it stops holding

• Some guests need no account at all. Keypad codes and NFC tags — "accountless credentials" — give owners a cheap legitimate path; one correct answer is to retire the account as the unit of admission, not to streamline the account flow. Lock products already work this way widely.
• Cultural resistance is real. Sharing carries emotional meaning in family contexts (intimacy, trust); framing all sharing as a security failure alienates users. What products can do is make the correct way to share equally effortless, not moralize.
• Unauthenticated channels neither suffer nor solve this. A device anyone in the room can command involves no account sharing — because it has no admission layer at all; that is a different failure from "bypassing the admission layer", and the two should not be conflated.

Applying it

• Compress the legitimate path to under two minutes with no app required on the guest side: the owner generates a keypad code / NFC grant / time-limited link on her own phone; the guest uses the code.
• Audit your flow's "password distance": count the steps and minutes of the legitimate path, then count the steps of "tell them the password"; if the former is not clearly shorter, the workaround wins.
• After launch, monitor workaround signals: one master account active across multiple unmanaged devices, family-chat screenshots of shared logins — these are honest alarms that the flow already lost, more honest than satisfaction surveys.
• How to check: formal guest grants created per hundred households versus households with multi-device master-account logins; when the former sits near zero while the latter is common, the granting flow is being bypassed in substance — the problem is the flow, not the users.

Related

• Same group: Z4.08.1 Guest access should default to least privilege with an explicit expiry · Z4.08.2 After expiry, access must revoke automatically · Z4.08.3 Guest actions need distinct records from family members'
• Nearby: Z4.07 Multiple users and permission allocation · Z6.02 Permission layering
• Search terms: credential sharing · password sharing · access granting friction · smart home