Short session expiration does not help security • Hacker News Board

Re: Short session expiration does not help security

#61

Post by TeMPOraL » Fri, Aug 18, 2023, 2:16 PM UTC

marcus0x62 wrote: post #43

horsawlarway wrote: post #18

Earlier quoted context omitted.

> Short sessions are there because there are various ways that sessions could be compromised. You haven't actually addressed either of the author's points, though. Namely: 1: A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal. 2: The vast majority of ways to compromise a session already give you access far beyond that session itself…

> 1: A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal. Need a citation on that “usually” part. A short session duration most definitely: * Makes it less likely that when an attacker obtains a session token that is is unexpired. * Gives the attacker less time to use a valid session token to move laterally into (potentially) unfamil…

> * Makes it less likely that when an attacker obtains a session token that is is unexpired.

But gives them more opportunities to acquire such token.

> * Gives the attacker less time to use a valid session token to move laterally into (potentially) unfamiliar infrastructure.

Only if tokens lifespan is counted in milliseconds. Otherwise, the attacker will refresh the session token as soon as they get it, and continue to do so. An active session token can be thought as having arbitrary long lifespan.

Re: Short session expiration does not help security

#62

Post by vel0city » Fri, Aug 18, 2023, 2:17 PM UTC

_tk_ wrote: post #5

Hand waving away the threat of application use on shared devices seems a little over confident to me. This is probably not a threat for company devices, but it is clearly a threat in other environments, i.e family members sharing a device. While some users might expect to be logged in all the time, others expect to be logged out after they close a web app tab. Session expiration should be application specific. Google…

> Google's sessions do not expire

They kind of do. I use a lot of machines that I might only hop on once a month or so. Chrome sync often ends up in a "paused" state where I have to re-auth. YouTube will fall back to a not-signed-in profile on me and I'll need to re-auth every now and then. Loading up Gmail will have me re-auth again pretty often. Often its not a full re-auth with my security keys but it'll at least challenge a password. I get these challenges probably every week or so across all my devices.

Re: Short session expiration does not help security

#63

Post by horsawlarway » Fri, Aug 18, 2023, 2:17 PM UTC

cj wrote: post #50

horsawlarway wrote: post #33

Earlier quoted context omitted.

> Nonsense, defence in depth is a core security principle. You should not rely on a single control to protect you. And you should not prioritize security over the goal of the product. The conversation is a discussion of relative value and tradeoffs. Does increasing security make the tool as a whole worse? Sometimes - the answer is yes. I have a nice set of front windows, but that means a risk of someone breaking thro…

The idea of “adaptive security” is compelling. E.g. my bank makes me type my password and sends 2fa codes when initiating/approving wire transfers… even when I just logged in a minute ago. If I’m doing 2 wire transfers in a row, it doesn’t care, it still has me fully reauthenticate for every wire transfer. But I’m fine with that because moving money is something that I’m willing to accept however many roadblocks are…

Agreed - this is a much better approach. The "session" that can do the normal daily tasks for users should last as long as you can make it.

The "session" that can do things like change 2fa/billing/contact-info (decidedly not-normal things) should last for exactly as long as it takes you to complete that form, and should require your pass/2fa again to touch.

This is currently Google's approach, and I find it much more sane.

Re: Short session expiration does not help security

#64

Post by BillinghamJ » Fri, Aug 18, 2023, 2:17 PM UTC

GoblinSlayer wrote: post #27

BillinghamJ wrote: post #12

Earlier quoted context omitted.

On all their websites. Microsoft is quite a bad offender of this also.

IME github session is almost eternal.

More Microsoft-branded then - GH's current session handling largely predates Microsoft

Re: Short session expiration does not help security

#65

Post by 8organicbits » Fri, Aug 18, 2023, 2:17 PM UTC

gabereiser wrote: post #36

Neither does “Your password cannot match your previous 1,000 passwords”. Let’s just keep everyone’s password and previous password around in a database shall we?

That usually works by storing the password hash, not the password itself.

Re: Short session expiration does not help security

#66

Post by bombcar » Fri, Aug 18, 2023, 2:18 PM UTC

8organicbits wrote: post #60

bombcar wrote: post #45

The proper way to handle the problem is to tie session IDs to more than just a cookie or other fixed value; so that if they get exfiltrated they cannot be used without reauthenticating. For example, the Session ID becomes "IP address + session token + browser ID" or something, then if I get your token, and even if I can mimic your browser fingerprint, I'd still have to be coming from your IP.

Careful about doing this. Laptop and phones change networks. If my wifi is weak you'll see my phone switch to data intermittently. Forcing me to re-auth every switch would be painful. Some VPN providers also change IP addresses regularly (I've seen <1 minute between switches).

You can adjust it to accommodate this, by allowing more than one single combo to be "legit" but it does add extra friction.

However, when combined with other things it can at least let "my browser, at my home on my fixed IP" not have to login every ten minutes.

Other systems handle this by only doing the "session detailed check" when you perform privileged activities.

Re: Short session expiration does not help security

#67

Post by klodolph » Fri, Aug 18, 2023, 2:18 PM UTC

water9 wrote: post #56

marcus0x62 wrote: post #43

Earlier quoted context omitted.

> 1: A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal. Need a citation on that “usually” part. A short session duration most definitely: * Makes it less likely that when an attacker obtains a session token that is is unexpired. * Gives the attacker less time to use a valid session token to move laterally into (potentially) unfamil…

Once the attacker knows they can steal the session ID, and how long it will be valid for. It’s just a matter of running a script to do that all that as fast as possible.

That’s one possible scenario.

The correct way to evaluate security is to consider many different scenarios, and consider how your mitigations affect the likelihoods of all of them, weighted by their impact.

Re: Short session expiration does not help security

#68

Post by thinkmassive » Fri, Aug 18, 2023, 2:19 PM UTC

datavirtue wrote: post #49

klodolph wrote: post #8

> Also, it would be better to protect against this by securing the logs or using hard drive encryption. This one line is emblematic of the flaws in the article. My take on the article is, “Imagine that everything else in a system is done correctly, and the system, overall, is perfectly secure. In this imaginary world, short sessions don’t help.” One fact about security which you cannot avoid is that any one particula…

Short sessions are obscurity...not security. If you use a serious website like Fidelity's, they don't let you do anything impactful without an authentication challenge. You could have logged in a few seconds ago...want to tinker with bank accounts? Challenge.

Fidelity also logs you out after a short duration of inactivity…

Re: Short session expiration does not help security

#69

Post by marcosdumay » Fri, Aug 18, 2023, 2:20 PM UTC

izacus wrote: post #47

horsawlarway wrote: post #18

Earlier quoted context omitted.

> Short sessions are there because there are various ways that sessions could be compromised. You haven't actually addressed either of the author's points, though. Namely: 1: A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal. 2: The vast majority of ways to compromise a session already give you access far beyond that session itself…

> So... going back to the point: If expiring sessions is terrible UX (and it is) and it's not stopping attackers (and it's not), why are you doing it? Everytime I get into this kind of discussion, the answer seems to be "because it makes me feel better". Which is why it's so impossible to actually change someones mind about it and thus we have security "experts" (or worse, non-technical managers) making life miserabl…

As the GP said, the attitude is cancer, and spreading is what it does.

It really doesn't help that "security expert" is a job title. That means this person is expected to deal with security, not business objectives, and will be blamed for security incidents, not business goals satisfied. If the OP's attitude is cancer, this is what causes it, and it's completely toxic.

Re: Short session expiration does not help security

#70

Post by vel0city » Fri, Aug 18, 2023, 2:21 PM UTC

gabereiser wrote: post #36

Neither does “Your password cannot match your previous 1,000 passwords”. Let’s just keep everyone’s password and previous password around in a database shall we?

You don't need to keep someone's plaintext password in the database to compare. Just re-calculate hashes against historical hashes at new password time. If the hashing process is secure keeping a few old hashes isn't really a security concern, especially if people are actually using unique passwords.

Now, normally this is tied to an automatic password rotation policy, because allowing a previous password completely undermines a rotation policy. The real thing to complain about and attack are these rotation policies, which are probably more harmful than helpful.