Minutes Regarding Shared Password Check
A team of seven people shares one OTT subscription using a password that nobody changed after the person who created the account left the organization.
Minutes Regarding Shared Password Check Incident Report: OTT Account Access Degradation, Shared Credential Environment
Incident Summary
At approximately 9:45pm on a Tuesday, a user attempted to log in to a shared streaming account and received an incorrect password error. The password had not been changed by any known party. The account's simultaneous stream limit had been reached, which is the other explanation for a failed login that presents as an incorrect password error, which is a different error that the system reports identically.
Seven people share this account. Six of them are currently watching something.
Background: The Shared Account Infrastructure
Shared access to a streaming subscription requires a level of organizational trust that most teams reserve for significantly more consequential systems. The password lives in a WhatsApp message from April 2020. It also lives in a notes app, a browser's saved passwords, and the memory of at least three people who have repeated it aloud on video calls without considering what was visible on screen.
The account's registered email belongs to someone who left in August. All seven current users receive password reset emails at that address, which none of them can access. This has not yet been a problem, which is a different status from not being a potential problem.
Incident Timeline
9:45pm: User A attempts login. Failure. 9:47pm: User A messages the group. "Is anyone on Netflix?" 9:48pm: Users B, C, D confirm they are watching. Users E and F do not respond. 9:51pm: User E responds that they started something and fell asleep. 9:53pm: User F responds that they are not watching, they just left a tab open. 9:54pm: User A logs in successfully. 9:56pm: User F closes the tab.
Finding
The incident was resolved without a password change. The resolution required eight minutes of group coordination to locate an inactive session and request its closure. This is faster than the alternative, which would require access to the registered email account, which is not available.
Secondary Finding
In the second year of OTT account stacking, the average household subscribes to 3.2 services. The average person can name 2.1 of them. The remainder are known only as line items on a credit card statement, or as background noise when someone falls asleep on the couch.
The shared password is the social contract for this infrastructure. Nobody signed it. It is being honored anyway.
Recommendation
Change the registered email to an accessible address before the existing one expires or is reassigned. This recommendation has been noted. It has been noted before.
The meeting is adjourned.