Short session expiration does not help security
sjoerdlangkemper.nl
Short session expiration does not help security
1–10 of 434 posts
Re: Short session expiration does not help security
#2Phew, now I will bump session time to a week, since shorter ones were bothering me a lot. Thank you! :D
Re: Short session expiration does not help security
#3Phew, now I will bump session time to a week, since shorter ones were bothering me a lot. Thank you! :D
A week? Here i was thinking 8 hours would be a luxury.
Re: Short session expiration does not help security
#4If an attacker steals a session cookie with XSS or session fixation, the attacker immediately gains access to a valid session and can keep performing requests to keep the session alive. An absolute timeout would limit the amount of time the attacker has, but realistically this wouldn’t really hinder any attacker.
It is a lot harder to obtain valid short term tokens than it is to obtain long lived tokens. The insecurity of long term tokens is demonstrated by the many Elon Musk crypto scams found on Youtube.
I do agree that it is always a question of risk/reward. But to argue against it by saying short term tokens don't provide any added security, because a hacker can still gain access to a valid short lived token is disingenuous.
Re: Short session expiration does not help security
#5Hand waving away the threat of application use on shared devices seems a little over confident to me. This is probably not a threat for company devices, but it is clearly a threat in other environments, i.e family members sharing a device. While some users might expect to be logged in all the time, others expect to be logged out after they close a web app tab.
Session expiration should be application specific. Google's sessions do not expire, so that more user data can be collected. That is clearly more valuable to them, than compromised accounts due to session hijacking. Them doing it, is not a great use case for others, because their value proposition is entirely different than for most other web applications.
Re: Short session expiration does not help security
#6https://learn.microsoft.com/en-us/azure/active-directory/con...
Those “sessions which never expire” do, in fact, expire. It’s just that there’s more to it than time. The author should read up on the reasoning behind primary refresh tokens and session tokens.
Re: Short session expiration does not help security
#7[deleted]
Re: Short session expiration does not help security
#8> Also, it would be better to protect against this by securing the logs or using hard drive encryption.
This one line is emblematic of the flaws in the article.
My take on the article is, “Imagine that everything else in a system is done correctly, and the system, overall, is perfectly secure. In this imaginary world, short sessions don’t help.”
One fact about security which you cannot avoid is that any one particular security feature may fail or be bypassed in some way. What are the consequences of this? Well, it means that you want multiple layers of security. Your server runs its daemons with minimal privileges so that a remote execution vulnerability needs to be combined with a privilege escalation vulnerability. You don’t think about the “right way” to secure something, but you think about multiple ways to secure something, and don’t stop securing it just because you’ve found one good option.
Short sessions are there because there are various ways that sessions could be compromised.
Re: Short session expiration does not help security
#9Someone please tell Apple, because they're the worst at expiring sessions. This (among other reasons) makes the developer experience terrible.
Re: Short session expiration does not help security
#10Someone please tell Apple, because they're the worst at expiring sessions. This (among other reasons) makes the developer experience terrible.
On what services? I’m not an iOS dev, but I just haven’t been hit with this on apple services as a user.