UpLink authenticates your client users (that is, people you assign requests to) with secure links sent via email, rather than allowing client users to create an account and set their own password. We do this because it is both more secure, and more convenient for your clients, given their specific usage pattens. Clients use UpLink (and applications like it) very infrequently, and these apps are often outside of the purview of your client's IT department. That presents it's own set of risks.
Access revocation
The biggest issue with allowing clients to create an account on a website that is not actively managed by the client’s IT department is the risk that access is not revoked upon employee termination. Most IT departments do not have their accounting firm’s systems in-scope for access revocation during off-boarding. This could lead to a scenario where a terminated employee can still access a website that stores confidential information. In fact, a recent study found that nearly 25% of employees still have access to accounts from a previous employer.
When the only way to access a site is through a temporary secure link that is sent to an email address managed by the client’s IT department, the risk that a terminated employee could obtain access is significantly reduced, as email is typically the first system to be removed upon termination.
Bad Practices with Passwords
In a recent survey performed by KeeperSecurity, a surprising number of employees admitted to bad password practices:
Writing down their passwords > 62%
Sharing passwords with team members > 46%
Using personal passwords for work accounts > 44%
The likelihood that an employee treats infrequently accessed sites with more care than one used daily is very low, as users are more likely to reuse passwords at sites they use less frequently.
Password Resets
In standard methodology of account/password management, the email account is presumed to be secure, as that is where account verification and password resets are performed. If the email account is compromised, all of the accounts of the websites registered to that email account are also compromised, because attackers can easily reset passwords. Therefore, because email is presumed to be secure, an account with a password is just an additional attack vector, as described in detail by Auth0.
About UpLink’s Secure Links
UpLink generates secure links that are cryptographically signed using keys with a search space significantly more than 10^100. That will keep today’s best supercomputers busy for many trillions of centuries. These links are sent directly to the inbox of the person assigned to a request and expire within 24 hours.
Conclusion
In general, passwords and secure links are both valid methods of protecting access to a site. However, when considering the fact that access to UpLink is unlikely to be revoked by the client’s IT department, as well as the widespread bad practices for passwords, the passwordless secure links used by UpLink are much more secure than using passwords.