Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: WebSession, a Secure Replacement for Cookies

websession.dev

Post reply on HN
Print view View original

91–100 of 113 posts

Re: Show HN: WebSession, a Secure Replacement for Cookies

#91

Post by apitman »

oefrha wrote: post #31
apitman wrote: post #21

Earlier quoted context omitted.

Timestamps can be vulnerable to clock attacks, right? Why not just include a monotonically increasing request number along with the nonce in each request?

What clock attack? You validate the timestamp on the server and reject if the timestamp is too far off. The same request being repeatable within say 30s isn’t a problem in 99% of cases.

I'm referring to threat models where the attacker might be able to manipulate time on the server, either directly or through NTP servers, etc. Personally it's not something I would worry about but I've heard it discussed and was wondering how big a concern it is.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#92

Post by apitman »

kortex wrote: post #22
apitman wrote: post #21

Earlier quoted context omitted.

Timestamps can be vulnerable to clock attacks, right? Why not just include a monotonically increasing request number along with the nonce in each request?

That interferes with the ability to send multiple requests in-flight at the same time.

Good point. Timestamps probably have a much better set of tradeoffs.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#93

Post by oefrha »

apitman wrote: post #91
oefrha wrote: post #31

Earlier quoted context omitted.

What clock attack? You validate the timestamp on the server and reject if the timestamp is too far off. The same request being repeatable within say 30s isn’t a problem in 99% of cases.

I'm referring to threat models where the attacker might be able to manipulate time on the server, either directly or through NTP servers, etc. Personally it's not something I would worry about but I've heard it discussed and was wondering how big a concern it is.

Well, then you still end up more secure than a regular session token.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#95

Post by latexr »

jampekka wrote: post #70
latexr wrote: post #66

Earlier quoted context omitted.

> Will not probably even lead to company fines, nor the disappearance of the illegal dark patterns. NOYB’s intervention has lead to fines and I’ve been seeing way more banners have a “Reject All” at the top level. I remember noticing that at the same time NOYB posted about it. Unfortunately I don’t remember any useful keyword to search their website and post the source. Though I’m not disagreeing with you. I have no…

Do you have a reference for the fines? Can't find much on the enforcement tracker [1], but seeing if the decision is about a nag or not is not easy to see quickly, so I may have missed them. NOYB also gave them a "grace period" before filing complaints, so I don't know how many complaints they actually made. A lot of the nags have indeed gotten less illegal lately. Although I have very little faith in that even click…

> Do you have a reference for the fines?

> (…)

> Also the promised megafines have not (and will not be) materialized

https://noyb.eu/en/spotify-fined-eu-5-million-gdpr-violation

https://noyb.eu/en/noyb-win-first-major-fine-eu-1-million-us...

https://noyb.eu/en/eu-58-million-fine-grindr-confirmed

Re: Show HN: WebSession, a Secure Replacement for Cookies

#96

Post by maxloh »

paulgb wrote: post #72
alexchamberlain wrote: post #43

Earlier quoted context omitted.

In short, you can't rely on the client doing _anything_, especially following the protocol correctly.

The proposal says that server-side expiration is still required. The ability to request that the client delete the token when the computer is locked is purely additive; if the client does not honor it, at worst you just get something equivalent to the status quo with cookies. If the client works correctly, you get a security feature that is currently impossible with cookies (wiping the session as soon as the laptop l…

It is possible currently. Just attach an `beforeunload` listener which asks the server to invalidate the current session.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#97

Post by latexr »

Zanfa wrote: post #80
jampekka wrote: post #63

Earlier quoted context omitted.

Very unlikely this will cause anybody to be fired. Will not probably even lead to company fines, nor the disappearance of the illegal dark patterns. E.g. a lot of sites used the IAB nag that was found illegal by the regulators. But IIUC only IAB had to pay a small fine and I'm quite sure nobody got fired for it because it was the "industry standard". NOYB is fighting the good fight, and without it GDPR would be even…

> NOYB is fighting the good fight, and without it GDPR would be even more useless. But it's a losing battle, and NYOB itself is sort of admitting that. https://noyb.eu/en/statement-4-years-gdpr I'm not sure how much of this is attributable to NOYB, but over the last year or two, years there's been a significant uptick in the number of "Reject All" buttons showing up and I have a hard time believing companies are putt…

> I'm not sure how much of this is attributable to NOYB, but over the last year or two, years there's been a significant uptick in the number of "Reject All" buttons

They filled over 500 complaints for that alone.

https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-is...

Re: Show HN: WebSession, a Secure Replacement for Cookies

#98

Post by xctr94 »

spiderfarmer wrote: post #47
janosdebugs wrote: post #41

> Because WebSession is dedicated to session maintenance and nothing else, a client could theoretically reject all cookies on any supporting site, ideally skipping the jarring cookie banner experience. This has nothing to do with cookies, the banner is required if the site is processing data that is not just technically necessary. In this case the site needs to ask the user for consent or at least inform them of proc…

Still lots of sites have cookie banners because the legal department demands them, even though they are not needed for the cookies they use.

And also because then users will automatically click “Accept All Cookies” as that’s the highlighted CTA. This reply is only mildly cynical.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#99

Post by jampekka »

latexr wrote: post #97
Zanfa wrote: post #80

Earlier quoted context omitted.

> NOYB is fighting the good fight, and without it GDPR would be even more useless. But it's a losing battle, and NYOB itself is sort of admitting that. https://noyb.eu/en/statement-4-years-gdpr I'm not sure how much of this is attributable to NOYB, but over the last year or two, years there's been a significant uptick in the number of "Reject All" buttons showing up and I have a hard time believing companies are putt…

> I'm not sure how much of this is attributable to NOYB, but over the last year or two, years there's been a significant uptick in the number of "Reject All" buttons They filled over 500 complaints for that alone. https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-is...

> Nevertheless, noyb will give companies a one-month grace period to comply with EU laws before filing the formal complaint.

They sent draft complaints to the companies. Not sure how many they sent to authorities. But nevertheless it may have had an effect.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#100

Post by jampekka »

latexr wrote: post #95
jampekka wrote: post #70

Earlier quoted context omitted.

Do you have a reference for the fines? Can't find much on the enforcement tracker [1], but seeing if the decision is about a nag or not is not easy to see quickly, so I may have missed them. NOYB also gave them a "grace period" before filing complaints, so I don't know how many complaints they actually made. A lot of the nags have indeed gotten less illegal lately. Although I have very little faith in that even click…

> Do you have a reference for the fines? > (…) > Also the promised megafines have not (and will not be) materialized https://noyb.eu/en/spotify-fined-eu-5-million-gdpr-violation https://noyb.eu/en/noyb-win-first-major-fine-eu-1-million-us... https://noyb.eu/en/eu-58-million-fine-grindr-confirmed

For Spotify and Tele2 at least these are cost-of-doing business fines. The GDPR can fine up to 4% of revenue. Spotify's revenue is about €17 billion, so the fine is about 0.03%. For Tele2 the fine amounts to 0.05%.

Grindr did get almost 3%, so that would be at the megafines level. Wonder how much they gained by selling the data though.

In comparison, I'd get easily fined over 3% of my yearly wage for shoplifting here in Finland. And of course would lose whatever I lifted. For Grindr-level privacy crimes I'd probably get a prison sentence. If you want to break the law, better make it for shareholder profit.

Post reply on HN