Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: WebSession, a Secure Replacement for Cookies

websession.dev

Post reply on HN
Print view View original

81–90 of 113 posts

Re: Show HN: WebSession, a Secure Replacement for Cookies

#81

Post by kardianos »

zacharyvoase wrote: post #51

Hi! Author of this proposal here. I’m loving all the feedback and wanted to address some things: * Yes, nonce tracking is expensive. HTTP request signatures could be used instead of nonces—they’re just not fully fleshed out yet, from what I can tell. And a lot of other crypto systems we rely on in Web traffic today also assume proper nonce tracking. Fortunately you only need to track distinct nonces per established s…

Noces are a non-starter for me.

You cite trivial issues such as setting flags on a cookie, then go on to require checking nonces for uniqueness. You know what most people would do? They would ignore the expensive nonce check.

This would turn this into an expensive client generated opeque token. How would you handle sites setup with sub domains?

Reading between the lines, it sounds like you want a alternative session method so legislation can force disallowing all cookies and tracking, or blanket ignoring them client side.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#82

Post by kardianos »

zacharyvoase wrote: post #51

Hi! Author of this proposal here. I’m loving all the feedback and wanted to address some things: * Yes, nonce tracking is expensive. HTTP request signatures could be used instead of nonces—they’re just not fully fleshed out yet, from what I can tell. And a lot of other crypto systems we rely on in Web traffic today also assume proper nonce tracking. Fortunately you only need to track distinct nonces per established s…

Trying again to be more constructive, rather than having a nonce, make the nonce meaningful, so there is a time component, such as seconds from initiating the session, and a validation portion that shows this came from the session function and attests the time portion is valid.

Then nonce storage, if you do it, can be limited to window when it is valid.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#83

Post by thayne »

diggan wrote: post #61
Beldin wrote: post #27

From the article: > As a result of increasingly strict privacy laws across the world, users are now beset with cookie banners across the Web In the words of a law prof from the Radboud University, more accurate is to say "as a result of an entire industry colluding to undermine legislation".

Seems like more companies than needed are confessing to misusing people's data. If you only use cookies for login or other essential information (not related to tracking people), you do not need to show any cookie banner . Same with the GDPR stuff, if you don't store more data about users than absolutely needed for essential functionality, GDPR isn't affecting you.

>if you don't store more data about users than absolutely needed for essential functionality, GDPR isn't affecting you.

Except you need to completely delete all data for users who close their account. Need to have a data protection officer, and need to have a way to give users all the data you have from them upon request. All of which can be a significant burden for small companies, or non-commercial websites.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#84

Post by archerx »

3c6bYDXLMj wrote: post #76
archerx wrote: post #49

Earlier quoted context omitted.

Maybe they need better legal departments that can actually read and understand laws?

[flagged]

That’s ironic because cookie banner feels soaked in deception. They should be called tracker banners instead of sugar coating it by calling it a cookie also the ask to try and extract data to be sold on a side market. Everytime I see a cookie banner I think I am not only a client but also a potential product and that makes me think less of the brand. Also it makes the site look ugly and cluttered.

You’d think you’d try to avoid the above of you had the option.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#85

Post by diggan »

thayne wrote: post #83
diggan wrote: post #61

Earlier quoted context omitted.

Seems like more companies than needed are confessing to misusing people's data. If you only use cookies for login or other essential information (not related to tracking people), you do not need to show any cookie banner . Same with the GDPR stuff, if you don't store more data about users than absolutely needed for essential functionality, GDPR isn't affecting you.

>if you don't store more data about users than absolutely needed for essential functionality, GDPR isn't affecting you. Except you need to completely delete all data for users who close their account. Need to have a data protection officer, and need to have a way to give users all the data you have from them upon request. All of which can be a significant burden for small companies, or non-commercial websites.

> Except you need to completely delete all data for users who close their account. Need to have a data protection officer, and need to have a way to give users all the data you have from them upon request. All of which can be a significant burden for small companies, or non-commercial websites.

Well, you're a good example about people misunderstanding GDPR :)

If you're a small company and processing data isn't a core part of your business and whatever the business does doesn't create risks for your users, there are parts of GDPR you don't have to care about, for example you don't need to have a DPO in that case.

GDPR is meant to protect users from businesses that are harvesting users data, in order to gain a bit of privacy back. It's not for your tiny SaaS that only requires a email to use and you collect no analytics about users.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#87

Post by rmbyrro »

New tech will not magically make developers security conscious.

We'll just make (different) silly mistakes with the new tech.

Instead of reinventing the wheel, why don't we just gradually improve the defaults for cookies in browsers and educate developers on using the tech we already have with security consciousness?

Re: Show HN: WebSession, a Secure Replacement for Cookies

#88

Post by notpushkin »

Retr0id wrote: post #71
zacharyvoase wrote: post #51

Hi! Author of this proposal here. I’m loving all the feedback and wanted to address some things: * Yes, nonce tracking is expensive. HTTP request signatures could be used instead of nonces—they’re just not fully fleshed out yet, from what I can tell. And a lot of other crypto systems we rely on in Web traffic today also assume proper nonce tracking. Fortunately you only need to track distinct nonces per established s…

On the nonce-tracking front, what about a monotonic counter? The client can generate the next nonce by incrementing the previous nonce value. The server only needs to remember the highest nonce it's ever seen, for a particular session, and reject any new nonces less than or equal to it. O(1) in time and space, and no need for anything clever like bloom filters. Edit: One issue I can see with this approach would be, w…

> You'd perhaps want to track a small window of nonces to account for this.

Just send a signed UTC timestamp instead of a nonce. Make it valid for like 5–15 seconds to ensure it doesn't break if clocks are out of sync slightly – it will still be better than cookies that live practically forever.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#89

Post by jampekka »

Zanfa wrote: post #80
jampekka wrote: post #63

Earlier quoted context omitted.

Very unlikely this will cause anybody to be fired. Will not probably even lead to company fines, nor the disappearance of the illegal dark patterns. E.g. a lot of sites used the IAB nag that was found illegal by the regulators. But IIUC only IAB had to pay a small fine and I'm quite sure nobody got fired for it because it was the "industry standard". NOYB is fighting the good fight, and without it GDPR would be even…

> NOYB is fighting the good fight, and without it GDPR would be even more useless. But it's a losing battle, and NYOB itself is sort of admitting that. https://noyb.eu/en/statement-4-years-gdpr I'm not sure how much of this is attributable to NOYB, but over the last year or two, years there's been a significant uptick in the number of "Reject All" buttons showing up and I have a hard time believing companies are putt…

When it comes to things that (big) business doesn't like - e.g. GDPR, tax evasion, antitrust, consumer rights, rule of law - enforcement is somehow always so so difficult. And when it comes to stuff like enforcing copyrights, patents, trade agreements and forced privatizations the enforcement works fine and dandy. GDPR enforcement was designed like it is and it was well known that it will be like this.

My take is that the corruption is not only a national matter, like europhiliacs and the EU's huge PR-propaganda machinery like to explain it. EU was set up as an antidemocratic organization for business interests and seems to remain so. The endless lobbying billions work.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#90

Post by tommiegannert »

willvarfar wrote: post #36
tommiegannert wrote: post #33

Earlier quoted context omitted.

There could be a window: the last N sequence numbers are kept in a set, where N is higher than the number of concurrent requests.

Doesn't the server discarding requests with the timestamp beyond a threshold already do windowing but statelessly?

I responded to this:

>> Timestamps can be vulnerable to clock attacks, right? Why not just include a monotonically increasing request number along with the nonce in each request?

> That interferes with the ability to send multiple requests in-flight at the same time.

I.e. it was assumed there was a sequence number, and I refuted that it disallows concurrent requests.

In general, I agree a signed timestamp is fine.

Post reply on HN