Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Short session expiration does not help security

sjoerdlangkemper.nl

Post reply on HN
Print view View original

11–20 of 434 posts

Re: Short session expiration does not help security

#11

Post by jan_Sate »

0bsecurity wrote: post #4

If an attacker steals a session cookie with XSS or session fixation, the attacker immediately gains access to a valid session and can keep performing requests to keep the session alive. An absolute timeout would limit the amount of time the attacker has, but realistically this wouldn’t really hinder any attacker. It is a lot harder to obtain valid short term tokens than it is to obtain long lived tokens. The insecuri…

This. It has to do with the window of time that the attacker could access the session. If a service is meant to be used, says, once every 3 months, setting the session expiry to 7 days would make the usable attack window 7/90 = 7.8%. However, if the expiry is infinite, the hacker could just access the session any time.

It's also much easier to obtain an active session token than to configure a tool that obtains the token of the future logins.

Perhaps it doesn't matter that much if the service is meant to be logged in all the times tho.

Re: Short session expiration does not help security

#12

Post by BillinghamJ »

toddmorey wrote: post #10
lapcat wrote: post #9

Someone please tell Apple, because they're the worst at expiring sessions. This (among other reasons) makes the developer experience terrible.

On what services? I’m not an iOS dev, but I just haven’t been hit with this on apple services as a user.

On all their websites. Microsoft is quite a bad offender of this also.

Re: Short session expiration does not help security

#15

Post by lapcat »

toddmorey wrote: post #10
lapcat wrote: post #9

Someone please tell Apple, because they're the worst at expiring sessions. This (among other reasons) makes the developer experience terrible.

On what services? I’m not an iOS dev, but I just haven’t been hit with this on apple services as a user.

App Store Connect, Feedback Assistant, developer.apple.com, etc.

Re: Short session expiration does not help security

#17

Post by Y-bar »

toddmorey wrote: post #10
lapcat wrote: post #9

Someone please tell Apple, because they're the worst at expiring sessions. This (among other reasons) makes the developer experience terrible.

On what services? I’m not an iOS dev, but I just haven’t been hit with this on apple services as a user.

I have to log in again pretty much daily on icloud.com even though I constantly click the "trust this device" checkbox.

Re: Short session expiration does not help security

#18

Post by horsawlarway »

klodolph wrote: post #8

> Also, it would be better to protect against this by securing the logs or using hard drive encryption. This one line is emblematic of the flaws in the article. My take on the article is, “Imagine that everything else in a system is done correctly, and the system, overall, is perfectly secure. In this imaginary world, short sessions don’t help.” One fact about security which you cannot avoid is that any one particula…

> Short sessions are there because there are various ways that sessions could be compromised.

You haven't actually addressed either of the author's points, though. Namely:

1: A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal.

2: The vast majority of ways to compromise a session already give you access far beyond that session itself (ex: you have user access on a local machine, or physical hardware access, or you're an admin who manages that user, etc/etc/etc). So an expired session is, at most, a small speed bump in those cases.

So... going back to the point: If expiring sessions is terrible UX (and it is) and it's not stopping attackers (and it's not), why are you doing it?

----

> You don’t think about the “right way” to secure something, but you think about multiple ways to secure something, and don’t stop securing it just because you’ve found one good option.

This attitude is cancer. Let me throw another quote at you:

"A ship in harbor is safe - but that is not what ships are built for."

----

Security is ALWAYS (fucking always, yes really - fucking always) a tradeoff.

The most secure application runs completely isolated, with no input or output, and is totally, utterly useless. But no worries - it's secure!

Re: Short session expiration does not help security

#19

Post by dakial1 »

klodolph wrote: post #8

> Also, it would be better to protect against this by securing the logs or using hard drive encryption. This one line is emblematic of the flaws in the article. My take on the article is, “Imagine that everything else in a system is done correctly, and the system, overall, is perfectly secure. In this imaginary world, short sessions don’t help.” One fact about security which you cannot avoid is that any one particula…

The author also puts lot’s of faith on the user not doing stupid things:

“Is this a thing? Are shared computers without user separation a thing? If so, these shouldn’t be used to access web applications with sensitive information at all, no matter how short the session expiry time is.”

Yeah, users might just leave their bank logged in a open and logged computer library. That’s why short sessions exist for those as this will limit the window of opportunity for a bad actor to do something bad. Not perfect of course, but limit the exposure.

Re: Short session expiration does not help security

#20

Post by horsawlarway »

_tk_ wrote: post #5

Hand waving away the threat of application use on shared devices seems a little over confident to me. This is probably not a threat for company devices, but it is clearly a threat in other environments, i.e family members sharing a device. While some users might expect to be logged in all the time, others expect to be logged out after they close a web app tab. Session expiration should be application specific. Google…

> Google's sessions do not expire, so that more user data can be collected. That is clearly more valuable to them, than compromised accounts due to session hijacking. Them doing it, is not a great use case for others, because their value proposition is entirely different than for most other web applications.

I think this is a pretty bad take. Google runs some very sensitive applications for paying enterprise customers, and they still tend to not expire sessions.

I also really don't like Google as an ad company, and I think my trust in their judgement has fallen precipitously over the last decade, but I find it hard to compare them to someone like Microsoft and say they're doing worse on the security front (I don't think they are).

Post reply on HN