Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


67 posts

Master Geek


Topic # 60432 26-Apr-2010 08:15
Send private message

Dear Kirk and team,

I have asked this via your support channel (more than once), but never got a response, so going public, and hoping some other Xero users will back me on this.

We've been using Xero for well over a year now, and I've always been concerned about the fact that our staff can access Xero from anywhere.

What I have asked for is the ability to lock down access per user by IP address, so that our admin staff can only access Xero from our office.   Obviously business owners would need to control this on a per user basis, so they (or anyone they want to trust) could continue to access Xero from home or mobile.  i.e. Access control via IP address should optional (per user).

Being an asp.net web developer I know this is easy to do (because we've acutally done exactly this for one of our clients' web admin systems),  but to be fair I don't have any insight to how your authentication systems work, and possible other issues.

This would be a huge selling point of Xero for those who fear putting their accounting system in the cloud makes it far too easy for their confidential financial information to be 'leaked' out by staff members.

Does anyone else agree this would be a great feature?  I would love to see it implemented soon.

Many thanks,
Tim

Create new topic
33 posts

Geek

Trusted
Xero

  Reply # 323033 26-Apr-2010 14:07
Send private message

Hi Tim,

We always appreciate feedback and suggestions. We do monitor requests for new features carefully and the restriction of user access by IP address has not featured as a common request at this stage. While this would offer some increased security control, it would not stop an authorised user leaking information via reports or other forms if they wanted to, as they could with any system. It could also prove frustrating when a staff member wanted to urgently access Xero from home or other out-of-office locations for legitimate reasons. 

At this stage our thinking would be to extend the current view of a User's 'last login' details to include the last 10 logins and the associated IP address for each session.   This would provide a broader audit trail of activity across all users with access to your organisation to help identify if any users account had been compromised or shared with persons from other locations. 

We'll be interested to see other customers feedback on this discussion. 

Cheers

Rod 





Xero (The world's easiest accounting system) | Xero Blog | 2009 Success & Survival Guide



BDFL - Memuneh
60835 posts

Uber Geek
+1 received by user: 11721

Administrator
Trusted
Geekzone
Lifetime subscriber

  Reply # 323036 26-Apr-2010 14:14
Send private message

I agree with Rod on this. While it may give some a (false) sense of security, it does nothing to prevent actual leak of data. According to some reports, most of these leaks are either inside jobs, or trojans planted on computers that are allowed to access that data.

This restriction wouldn't make it any harder for people to get hold of this information if they really wanted to, but would make it harder for people who actually work with that every day...






67 posts

Master Geek


  Reply # 323050 26-Apr-2010 14:30
Send private message

Thanks Rod,

I hear where you're coming from.  I agree that using any accounting system, a rogue employee could 'leak' financial data, my main point is with Xero this is incredibly easy as compared to something like MYOB. It also requires no planning or secrecy to take data outside of the company's office/network (for example they could get their smartphone out at the pub after a few beers and show financials to anyone who asks 'what's Xero like').

I like your suggestion, perhaps with addition of persisting the last know 5 [unique] IP addresses (so that it's clear to business owners if external access has happened). 

At the moment our employee contract states that Xero should not be accessed outside our office, but there is no way of enforcing or tracking that. 

Maybe another way around this concern is for a list of allowed IP addresses, and an alert to administrators (upon next login) if a user logs in from any other IP address (eg ! Tim Thomas accessed this Xero account from 192.168.1.1 at 9.15 a.m on 14/04/2010). 

Thanks for listening!
Tim

33 posts

Geek

Trusted
Xero

  Reply # 323090 26-Apr-2010 15:43
Send private message

Great ideas.

Rod 





Xero (The world's easiest accounting system) | Xero Blog | 2009 Success & Survival Guide



261 posts

Ultimate Geek


  Reply # 323091 26-Apr-2010 15:46
Send private message

Hey guys.

I haven't used Xero, so I'm not sure what features you currently have regarding this sort of stuff. Looking at the original feature request, I can see how this would not be useful for the majority of users (one of the main advantages of using webbased SaaS is that you can use it from any computer / IP address).

However, to achieve what the OP wants, maybe a different tack could be used. Instead of locking down based on IP address, Xero could allow the user to view what users have logged on to the System, via what IP address.

Currently, most internet banking sites and even gmail allows you to see when you were last logged on and what IP address you logged on with. If Xero provided the ability for the OP to generate a report that listed all users / IP address and times, the OP would be able to check if his staff have been logging in at home, and then handle the issue via some sort of business process.

It would just help the OP - it would also benefit the slightly paranoid, who want to check that someone else hasn't been using their account. Essentially, Xero will only be giving the users more information about their security so they can choose the most appropriate action.

Just an idea anyway. I'll send you an invoice for the analysis later, eh?

261 posts

Ultimate Geek


  Reply # 323093 26-Apr-2010 15:49
Send private message

JellyWeb: Thanks Rod,

I like your suggestion, perhaps with addition of persisting the last know 5 [unique] IP addresses (so that it's clear to business owners if external access has happened). 




That is what I get for being a slow typer - you got there before I did.
 

Create new topic

Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Hawaiki Transpacific cable ready-for-service
Posted 20-Jul-2018 11:29


Microsoft Dynamics 365 Business Central launches
Posted 10-Jul-2018 10:40


Spark completes first milestone in voice platform upgrade
Posted 10-Jul-2018 09:36


Microsoft ices heated developers
Posted 6-Jul-2018 20:16


PB Technologies charged for its extended warranties and warned for bait advertising
Posted 3-Jul-2018 15:45


Almost 20,000 people claim credits from Spark
Posted 29-Jun-2018 10:40


Cove sells NZ's first insurance policy via chatbot
Posted 25-Jun-2018 10:04


N4L helping TAKA Trust bridge the digital divide for Lower Hutt students
Posted 18-Jun-2018 13:08


Winners Announced for 2018 CIO Awards
Posted 18-Jun-2018 13:03


Logitech Rally sets new standard for USB-connected video conference cameras
Posted 18-Jun-2018 09:27


Russell Stanners steps down as Vodafone NZ CEO
Posted 12-Jun-2018 09:13


Intergen recognised as 2018 Microsoft Country Partner of the Year for New Zealand
Posted 12-Jun-2018 08:00


Finalists Announced For Microsoft NZ Partner Awards
Posted 6-Jun-2018 15:12


Vocus Group and Vodafone announce joint venture to accelerate fibre innovation
Posted 5-Jun-2018 10:52


Kogan.com to launch Kogan Mobile in New Zealand
Posted 4-Jun-2018 14:34



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.