Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


JellyWeb

67 posts

Master Geek


#60432 26-Apr-2010 08:15
Send private message

Dear Kirk and team,

I have asked this via your support channel (more than once), but never got a response, so going public, and hoping some other Xero users will back me on this.

We've been using Xero for well over a year now, and I've always been concerned about the fact that our staff can access Xero from anywhere.

What I have asked for is the ability to lock down access per user by IP address, so that our admin staff can only access Xero from our office.   Obviously business owners would need to control this on a per user basis, so they (or anyone they want to trust) could continue to access Xero from home or mobile.  i.e. Access control via IP address should optional (per user).

Being an asp.net web developer I know this is easy to do (because we've acutally done exactly this for one of our clients' web admin systems),  but to be fair I don't have any insight to how your authentication systems work, and possible other issues.

This would be a huge selling point of Xero for those who fear putting their accounting system in the cloud makes it far too easy for their confidential financial information to be 'leaked' out by staff members.

Does anyone else agree this would be a great feature?  I would love to see it implemented soon.

Many thanks,
Tim

Create new topic
RodDrury
33 posts

Geek

Trusted
Xero

  #323033 26-Apr-2010 14:07
Send private message

Hi Tim,

We always appreciate feedback and suggestions. We do monitor requests for new features carefully and the restriction of user access by IP address has not featured as a common request at this stage. While this would offer some increased security control, it would not stop an authorised user leaking information via reports or other forms if they wanted to, as they could with any system. It could also prove frustrating when a staff member wanted to urgently access Xero from home or other out-of-office locations for legitimate reasons. 

At this stage our thinking would be to extend the current view of a User's 'last login' details to include the last 10 logins and the associated IP address for each session.   This would provide a broader audit trail of activity across all users with access to your organisation to help identify if any users account had been compromised or shared with persons from other locations. 

We'll be interested to see other customers feedback on this discussion. 

Cheers

Rod 





Xero (The world's easiest accounting system) | Xero Blog | 2009 Success & Survival Guide



freitasm
BDFL - Memuneh
68489 posts

Uber Geek

Administrator
Trusted
Geekzone
Lifetime subscriber

  #323036 26-Apr-2010 14:14
Send private message

I agree with Rod on this. While it may give some a (false) sense of security, it does nothing to prevent actual leak of data. According to some reports, most of these leaks are either inside jobs, or trojans planted on computers that are allowed to access that data.

This restriction wouldn't make it any harder for people to get hold of this information if they really wanted to, but would make it harder for people who actually work with that every day...




 

 

These links are referral codes

 

Geekzone broadband switch | Eletricity comparison and switch | Hatch investment (NZ$ 10 bonus if NZ$100 deposited within 30 days) | Sharesies | Mighty Ape | Backblaze | Amazon | My technology disclosure


 
 
 
 


JellyWeb

67 posts

Master Geek


  #323050 26-Apr-2010 14:30
Send private message

Thanks Rod,

I hear where you're coming from.  I agree that using any accounting system, a rogue employee could 'leak' financial data, my main point is with Xero this is incredibly easy as compared to something like MYOB. It also requires no planning or secrecy to take data outside of the company's office/network (for example they could get their smartphone out at the pub after a few beers and show financials to anyone who asks 'what's Xero like').

I like your suggestion, perhaps with addition of persisting the last know 5 [unique] IP addresses (so that it's clear to business owners if external access has happened). 

At the moment our employee contract states that Xero should not be accessed outside our office, but there is no way of enforcing or tracking that. 

Maybe another way around this concern is for a list of allowed IP addresses, and an alert to administrators (upon next login) if a user logs in from any other IP address (eg ! Tim Thomas accessed this Xero account from 192.168.1.1 at 9.15 a.m on 14/04/2010). 

Thanks for listening!
Tim

RodDrury
33 posts

Geek

Trusted
Xero

  #323090 26-Apr-2010 15:43
Send private message

Great ideas.

Rod 





Xero (The world's easiest accounting system) | Xero Blog | 2009 Success & Survival Guide



patatrat
261 posts

Ultimate Geek


  #323091 26-Apr-2010 15:46
Send private message

Hey guys.

I haven't used Xero, so I'm not sure what features you currently have regarding this sort of stuff. Looking at the original feature request, I can see how this would not be useful for the majority of users (one of the main advantages of using webbased SaaS is that you can use it from any computer / IP address).

However, to achieve what the OP wants, maybe a different tack could be used. Instead of locking down based on IP address, Xero could allow the user to view what users have logged on to the System, via what IP address.

Currently, most internet banking sites and even gmail allows you to see when you were last logged on and what IP address you logged on with. If Xero provided the ability for the OP to generate a report that listed all users / IP address and times, the OP would be able to check if his staff have been logging in at home, and then handle the issue via some sort of business process.

It would just help the OP - it would also benefit the slightly paranoid, who want to check that someone else hasn't been using their account. Essentially, Xero will only be giving the users more information about their security so they can choose the most appropriate action.

Just an idea anyway. I'll send you an invoice for the analysis later, eh?

patatrat
261 posts

Ultimate Geek


  #323093 26-Apr-2010 15:49
Send private message

JellyWeb: Thanks Rod,

I like your suggestion, perhaps with addition of persisting the last know 5 [unique] IP addresses (so that it's clear to business owners if external access has happened). 




That is what I get for being a slow typer - you got there before I did.
 

Create new topic




News »

Amazon introduces new Echo devices
Posted 25-Sep-2020 11:56


Mad Catz introduces new S.T.R.I.K.E. 13 Mechanical Gaming Keyboard
Posted 25-Sep-2020 11:34


Vodafone NZ upgrades international submarine network
Posted 25-Sep-2020 09:09


Jabra announces wireless noise-cancelling airbuds, upgrade existing model
Posted 24-Sep-2020 14:43


Nokia 3.4 to be available in New Zealand
Posted 24-Sep-2020 14:34


HP announces new HP ENVY laptops aimed at content creators
Posted 24-Sep-2020 14:02


Logitech introduce MX Anywhere 3
Posted 21-Sep-2020 21:17


Countdown unveils contactless shopping with new Scan&Go tech
Posted 21-Sep-2020 09:48


HP unveils new innovations for businesses adapting to rapidly evolving workstyles and workforces
Posted 17-Sep-2020 15:36


GoPro launches new HERO9 Black camera
Posted 17-Sep-2020 09:45


Telecommunications industry launches new 5G Facts website
Posted 17-Sep-2020 07:56


New Zealand ranks 3rd in world in GSMA index
Posted 15-Sep-2020 10:13


Trend Micro Security Suite adds web monitoring to prevent identity theft
Posted 14-Sep-2020 15:37


NVIDIA to acquire Arm for US$ 40 billion
Posted 14-Sep-2020 12:27


Epson launches its next gen A3+ colour EcoTank multi-function printer
Posted 10-Sep-2020 16:08



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.