Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Short session expiration does not help security

sjoerdlangkemper.nl

Post reply on HN
Print view View original

31–40 of 434 posts

Re: Short session expiration does not help security

#31

Post by [deleted] »

horsawlarway wrote: post #18
klodolph wrote: post #8

> Also, it would be better to protect against this by securing the logs or using hard drive encryption. This one line is emblematic of the flaws in the article. My take on the article is, “Imagine that everything else in a system is done correctly, and the system, overall, is perfectly secure. In this imaginary world, short sessions don’t help.” One fact about security which you cannot avoid is that any one particula…

> Short sessions are there because there are various ways that sessions could be compromised. You haven't actually addressed either of the author's points, though. Namely: 1: A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal. 2: The vast majority of ways to compromise a session already give you access far beyond that session itself…

[deleted]

Re: Short session expiration does not help security

#32

Post by MattPalmer1086 »

There are two use cases here which are different.

Inactivity session termination mostly just protects against someone using your device if you leave it temporarily unattended.

Absolute session termination is a different control, which protects against compromise of the session token. So someone who hacks the device and gets the session token can only use it for a period, after which they would need your credentials to get another one. This is usually longer than inactivity termination.

Re: Short session expiration does not help security

#33

Post by horsawlarway »

MattPalmer1086 wrote: post #23
horsawlarway wrote: post #18

Earlier quoted context omitted.

> Short sessions are there because there are various ways that sessions could be compromised. You haven't actually addressed either of the author's points, though. Namely: 1: A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal. 2: The vast majority of ways to compromise a session already give you access far beyond that session itself…

> This attitude is cancer. Let me throw another quote at you Nonsense, defence in depth is a core security principle. You should not rely on a single control to protect you.

> Nonsense, defence in depth is a core security principle. You should not rely on a single control to protect you.

And you should not prioritize security over the goal of the product.

The conversation is a discussion of relative value and tradeoffs. Does increasing security make the tool as a whole worse? Sometimes - the answer is yes.

I have a nice set of front windows, but that means a risk of someone breaking through them. I accept that risk for the windows - the extra light and visibility is well worth it, and the windows are not the only way in. Compare to short sessions.

Re: Short session expiration does not help security

#35

Post by mgbmtl »

GoblinSlayer wrote: post #30
klodolph wrote: post #8

> Also, it would be better to protect against this by securing the logs or using hard drive encryption. This one line is emblematic of the flaws in the article. My take on the article is, “Imagine that everything else in a system is done correctly, and the system, overall, is perfectly secure. In this imaginary world, short sessions don’t help.” One fact about security which you cannot avoid is that any one particula…

Librewolf has an option to delete cookies on exit. Then you are as secure as possible.

Except if the cookie is copied elsewhere, then that cookie/session needs to be expired?

(but yes, expiring locally reduces the window for copying that cookie)

Re: Short session expiration does not help security

#37

Post by briHass »

It's worth noting that many services that offer longer session length also have tools for managing those open sessions and alert emails that geolocate IP addresses using those sessions. I'm sure the big boys do all kinds of statistical (AI if talking to marketing) analysis on session usage metadata (current IP, browser fingerprints, time of day) to try to determine if a session token/cookie has been compromised.

All that is a lot of extra effort and UI work for a web application that doesn't have the same immediate access expectations as a web email client or social media. Besides, many users use a password manager that autofills, so login isn't that painful as long as the 2FA persistent setting is respected.

Re: Short session expiration does not help security

#38

Post by gabereiser »

sjmulder wrote: post #14

What I wonder is why do we apply such different standards/expectations to web and non web apps? E.g. desktop Slack doesn’t ask me to log in all the time. Are web app tokens that much more easily stolen? What about Electron apps then?

Often it’s because your JWT hasn’t expired, your IP matches previous, and so you’re authentic. Local storage is local storage whether it’s electron or browser.

If your JWT was close to expiry and your IP address is different and your user agent or headers are different then it may force to re-authenticate.

Re: Short session expiration does not help security

#40

Post by allanbreyes »

chpmrc wrote: post #24

Is there a list of "security advice that doesn't really make sense but we keep following just because"? This is a great one, another good one is regularly changing passwords. What else?

NIST dropped the password change recommendation a while back [1] but it still lingers on. The staying power and long tail of this deprecated advice is unfortunate, to say the least.

I don't personally agree that short sessions is bad advice, but Phil Venables has an article that you might enjoy, "Ceremonial Security and Cargo Cults" [2]

[1] https://pages.nist.gov/800-63-FAQ/#q-b05

[2] https://www.philvenables.com/post/ceremonial-security-and-ca...

Post reply on HN