How should teams authenticate workers on shared devices without using shared logins?

Why shared-device authentication should stay per person, not per workstation

On a shared device, the security unit that matters is the session, not the terminal. Each worker should prove who they are with a personal factor or device-bound factor, then receive a time-bounded session that can be traced to that individual. That preserves accountability, reduces credential sharing, and makes sign-out or timeout a meaningful control instead of a formality.

For frontline and kiosk-style environments, the practical requirement is that the device can be reused without reusing the login. The worker may tap a badge, use a smart card, present a biometric, or complete a short-lived sign-in flow, but the resulting access should still be tied to a named identity and expire cleanly when the shift or task ends.

That is why shared usernames are a weak fit for modern shared-device operations. They collapse attribution, make revocation blunt, and create hidden dependence on everyone handling the account correctly. A per-person session model lets teams keep the convenience of a common device while preserving individual access control.

How device-bound sign-in works in practice

The strongest pattern is to separate user identity from device ownership. The device can be managed as a trusted endpoint, but the sign-in event should still establish which worker is present. In practice that means using authentication methods that are resistant to casual sharing, such as badge tap, smart card, biometric sign-in, passkey-style flows, or a temporary token that is issued for that worker and that device.

This approach works best when the system can bind the session to both the person and the workstation. If the worker walks away, the session should lock or time out quickly. If the device changes hands, the next user should get a fresh authentication event rather than inheriting a live session. That is the difference between a shared device and a shared account.

For environments with repetitive logon and logoff, the right design goal is fast reauthentication without password reuse. The more you can make sign-in a local, short-lived, device-aware event, the less pressure there is to create a universal login that becomes impossible to govern.

What good session control looks like on kiosks and frontline devices

Good shared-device control is visible in the session lifecycle. The session starts only after an explicit identity check, it is scoped to the task or shift, and it is cleared when the worker signs out or becomes inactive. That means the device should not retain previous app state, cached access, or a lingering authenticated browser session that the next user can inherit.

• Use a distinct identity for each worker, even when the device is communal.
• Prefer sign-in methods that are tied to the device and difficult to hand off casually.
• Set short inactivity timeouts where the operational flow allows it.
• Clear sessions, tokens, and application state at sign-out.
• Make the reauthentication path fast enough that staff do not look for workarounds.

A useful operational test is simple: if the next worker can continue where the previous worker left off without proving their own identity, the control is too weak. If the system can recover quickly after sign-out without exposing the prior session, the workflow is much closer to what shared-device environments need.

Risk and Threat Considerations

Shared logins create more than inconvenience, they create shared blame and shared exposure. If one person can authenticate as everyone, you lose auditability, increase the blast radius of a compromise, and make it harder to tell whether an action came from an authorised worker, a curious colleague, or an attacker using a leaked account.

Failure mechanism: A shared username or reusable password turns the device into a standing access path. Once that account is known, stolen, guessed, or casually reused, every person on that station inherits the same access, and session theft or forgotten sign-out can extend that access beyond the intended shift.

Impact: Misattribution, overbroad access, and delayed revocation become routine. In regulated or safety-critical settings, that can also undermine incident review, supervisory accountability, and response to suspected misuse.

Practitioner Guidance

What to verify: Confirm that each workstation has a clean sign-out path that actually invalidates the prior session, not just the visible screen lock. Check whether app sessions, browser tokens, and local caches are cleared consistently when the worker leaves.

Decision rule: If the device is used by multiple workers across a shift, choose an authentication method that can be completed quickly but still identifies one person uniquely. If the workflow requires anonymous access for convenience, treat that as a control gap rather than a default design choice.

What practitioners underestimate: The weak point is often not first sign-in, but handoff. A system can look secure at login and still be unsafe if the next worker can inherit the previous person’s live session, saved app state, or delayed timeout.

Practitioner takeaway: The goal is not to make shared devices feel like personal devices, it is to make every session individually attributable, short-lived, and disposable between users.

Related resources from NHI Mgmt Group

• Guide: Kiosk and Shared Device Security Guide
• How should healthcare organisations secure shared mobile devices without slowing clinicians down?
• Why do shared devices create more identity risk than standard workstation logins?
• How should manufacturers eliminate shared logins in OT without disrupting operations?
• How should healthcare organizations reduce workflow friction without weakening access control on shared clinical devices?