short sessions exist to enable token revocation that does not require a central sync point (aside from time servers)
Short session expiration does not help security
111–120 of 434 posts
Re: Short session expiration does not help security
#112Earlier quoted context omitted.
> Nonsense, defence in depth is a core security principle. You should not rely on a single control to protect you. And you should not prioritize security over the goal of the product. The conversation is a discussion of relative value and tradeoffs. Does increasing security make the tool as a whole worse? Sometimes - the answer is yes. I have a nice set of front windows, but that means a risk of someone breaking thro…
That is a straw man argument. Nobody was saying security should be prioritised over the goal of the product. Security is just another non functional requirement (mostly) of a product. To obtain good enough security, defence in depth is still a good principle to follow. It means you are not putting all your eggs in one basket. It often means that each individual control does not have to be perfect or massively over en…
So in this case, when short sessions are a clear negative for a lot of products, and we have existing examples of HUGE enterprise companies that have agreed and adjusted those sessions to be much longer for most cases...
I would argue that you are arguing to prioritize security over the goal of the product. Right here and right now - you are literally doing it.
> To obtain good enough security, defence in depth is still a good principle to follow.
I don't disagree! I just think that each "defense" needs to actually be considered on the whole, not as just another bonus to security. Short sessions SUUUUUUUUUCK. They make your product shitty. Users hate them. They don't add a ton of security.
Are there products that should still have them? Sure. Probably lots of products in VERY specific places. Should they be the default everywhere? Sure as hell not.
Re: Short session expiration does not help security
#113> Also, it would be better to protect against this by securing the logs or using hard drive encryption. This one line is emblematic of the flaws in the article. My take on the article is, “Imagine that everything else in a system is done correctly, and the system, overall, is perfectly secure. In this imaginary world, short sessions don’t help.” One fact about security which you cannot avoid is that any one particula…
>One fact about security which you cannot avoid is that any one particular security feature may fail or be bypassed in some way. What are the consequences of this? Well, it means that you want multiple layers of security.
I think the problem here is that no one ever attempts to define what "multiple" is in layers. Most seem to agree that one layer often isn't enough for the reason pointed out.
The issue I take is no one knows or provides any sort of guidance of how many layers are enough. People working in security take a degree of liability in their jobs, perhaps careers, for compromises. As such, all the incentives are to add as many layers as possible, everywhere. So we get N-factor Auth, continuously expiring passwords, biometrics, regularly expiring physical access credentials, sessions that are increasingly fleeting and often work requires layers of these sessions so you end up with multiple compounding needs to reauthenticate to the network, to some remote application debugger, to some application running within an application, and so on.
I often work in secure environments and it gets tiring, tiring to the point I admittedly start to take shortcuts to make my life easier, shortcuts that ultimately defeat a few layers of security in some way to keep my sanity so I can... do the actual work.
So the other extreme of 1 layer of security is N layers of security where nothing is ever usable. There need to be some reasonable protocols in place and people who write them need to be forced to actually go through the use cases with a combination of efficiency/production quotas. Only then do I believe security starts to realize an appropriate balance of layering security and creating value. In the current state of affairs, a lot of places are off the rails where they add so many barriers for normal use they create behaviors in authorized users to open very bad holes whereas if a few layers were peeled back and appropriately managed, the overall security of a given system would likely improve.
Re: Short session expiration does not help security
#114In a lot of cases, short session expiry is used as a hack around subpar authentication standards such as SAML/OIDC where there is no reliable backchannel for the identity provider to tell the service to expire sessions (following a credential change, user being deleted, etc). The short session expiry is used as a workaround to force the third-party service to regularly check-in with the identity provider, thus placin…
This is correct, but its uncharitable to call it a "hack" in many contexts. In oauth, for example, the access token / refresh token concept is literally spelled out in the spec. It's not a workaround, its how you implement eventual consistency in a loosely coupled system where the IDP can't push updates to clients because it doesn't know all of them by design
Hang on, we're talking about user sessions and you're talking about access tokens.
Short expiration of sessions is bad because of the terrible UX. Access tokens can be refreshed without user interaction, so it's not the same issue there.
Re: Short session expiration does not help security
#115Earlier quoted context omitted.
> You're really angry with that straw man you've stood up. The OP isn't saying systems have to be locked down to the extent that they're useless. Who would ever argue for such a thing? You are - you're literally arguing for it right now. Short sessions just don't help all that much, and they have an outsized impact on users. Why are you dying on this hill? Likely because your mindset is "security above all else" and…
Literally cancer? Really?
Yes. Literally.
I would say it makes an excellent analogy: A part of the whole (security) is prioritizing themselves and their needs in a way that makes the overall organism much less capable and effective.
Cancer.
Re: Short session expiration does not help security
#116> Also, it would be better to protect against this by securing the logs or using hard drive encryption. This one line is emblematic of the flaws in the article. My take on the article is, “Imagine that everything else in a system is done correctly, and the system, overall, is perfectly secure. In this imaginary world, short sessions don’t help.” One fact about security which you cannot avoid is that any one particula…
Also pointless: "your session will expire in X minutes; click Continue to stay logged in" alerts. That just turns a short session into a long session? And provides a handy session.renew() call for the attacker?
Re: Short session expiration does not help security
#117The point of short sessions last I saw is not necessarily for technical reasons but for helping with legal reasons. That is, it means to lawyers that an authorized user could not have performed actions outside of a certain time window. This makes the discovery period for legal proceedings substantially faster.
Re: Short session expiration does not help security
#118In a lot of cases, short session expiry is used as a hack around subpar authentication standards such as SAML/OIDC where there is no reliable backchannel for the identity provider to tell the service to expire sessions (following a credential change, user being deleted, etc). The short session expiry is used as a workaround to force the third-party service to regularly check-in with the identity provider, thus placin…
There’s a solution for this! It’s called SCIM and it lets you sync user updates from the directory so you can expire sessions when users are deactivated.
(I work at WorkOS.com which helps developers with this.)
Re: Short session expiration does not help security
#119Hand waving away the threat of application use on shared devices seems a little over confident to me. This is probably not a threat for company devices, but it is clearly a threat in other environments, i.e family members sharing a device. While some users might expect to be logged in all the time, others expect to be logged out after they close a web app tab. Session expiration should be application specific. Google…
If you live with a family, you don't have any security margin: an unattended computer gets the next user immediately and a lot can be done in just one minute.
Re: Short session expiration does not help security
#120Earlier quoted context omitted.
As the GP said, the attitude is cancer, and spreading is what it does. It really doesn't help that "security expert" is a job title. That means this person is expected to deal with security, not business objectives, and will be blamed for security incidents, not business goals satisfied. If the OP's attitude is cancer, this is what causes it, and it's completely toxic.
Exactly. Anyone working in a moderately large company (500+ employees) or in a regulated industry is familiar with this issue. Just as no politician wants to be seen as soft on crime, no CISO want's to be blamed for a security breach. So more and more security gets piled on to every process and application. MFA everywhere, even though you're required to use MFA for the VPN. SSO everywhere, because why not. Session ex…
The reason why your business can "afford" this inefficiency is due to regulatory moats.
Big companies are like governments, and when you remove outside market pressure, they become even more so.