Short session expiration does not help security • Hacker News Board

Re: Short session expiration does not help security

#121

Post by seanp2k2 » Fri, Aug 18, 2023, 3:25 PM UTC

greedo wrote: post #108

marcosdumay wrote: post #69

Earlier quoted context omitted.

As the GP said, the attitude is cancer, and spreading is what it does. It really doesn't help that "security expert" is a job title. That means this person is expected to deal with security, not business objectives, and will be blamed for security incidents, not business goals satisfied. If the OP's attitude is cancer, this is what causes it, and it's completely toxic.

Exactly. Anyone working in a moderately large company (500+ employees) or in a regulated industry is familiar with this issue. Just as no politician wants to be seen as soft on crime, no CISO want's to be blamed for a security breach. So more and more security gets piled on to every process and application. MFA everywhere, even though you're required to use MFA for the VPN. SSO everywhere, because why not. Session ex…

“We can’t afford to not do it”

Re: Short session expiration does not help security

#122

Post by seanp2k2 » Fri, Aug 18, 2023, 3:27 PM UTC

horsawlarway wrote: post #107

mcdonje wrote: post #103

Earlier quoted context omitted.

Sometimes the answer is "so our sales team can tell people our security is better than our competitors."

Hah, I worked for a software security company. This is literally the entire industry. Check these boxes to be compliant to make that enterprise sale. Is it actually more secure? Who cares, insurance will cover us now and the enterprise paid us.

I still have PTSD from dealing with HIPAA and SOX stuff. Don’t run your own credit card processing if at all possible.

Re: Short session expiration does not help security

#123

Post by joshstrange » Fri, Aug 18, 2023, 3:27 PM UTC

amelius wrote: post #22

Also, not respecting your own "Remember me" checkboxes does not make happy customers.

My pet theory on this is developers never test it and QA rarely do either. Both groups are logging in/out constantly and if that checkbox doesn't work it's easy to fob off as "maybe I didn't check it?" or "my account switching broke it but that's a special case".

Every time I have to login again to a website that I told to remember me or "trust this computer" I get frustrated and then immediately think "Ehh, I understand how this happens". In a time when a password manager is nearly a requirement it's not the end of the world but it still bugs me since I really don't think most of my sessions have any need to expire unless I explicitly log out (or void all my remote sessions).

Re: Short session expiration does not help security

#124

Post by konschubert » Fri, Aug 18, 2023, 3:28 PM UTC

horsawlarway wrote: post #63

cj wrote: post #50

Earlier quoted context omitted.

The idea of “adaptive security” is compelling. E.g. my bank makes me type my password and sends 2fa codes when initiating/approving wire transfers… even when I just logged in a minute ago. If I’m doing 2 wire transfers in a row, it doesn’t care, it still has me fully reauthenticate for every wire transfer. But I’m fine with that because moving money is something that I’m willing to accept however many roadblocks are…

Agreed - this is a much better approach. The "session" that can do the normal daily tasks for users should last as long as you can make it. The "session" that can do things like change 2fa/billing/contact-info (decidedly not-normal things) should last for exactly as long as it takes you to complete that form, and should require your pass/2fa again to touch. This is currently Google's approach, and I find it much more…

GitHub does this too.

Re: Short session expiration does not help security

#125

Post by User23 » Fri, Aug 18, 2023, 3:28 PM UTC

horsawlarway wrote: post #18

klodolph wrote: post #8

> Also, it would be better to protect against this by securing the logs or using hard drive encryption. This one line is emblematic of the flaws in the article. My take on the article is, “Imagine that everything else in a system is done correctly, and the system, overall, is perfectly secure. In this imaginary world, short sessions don’t help.” One fact about security which you cannot avoid is that any one particula…

> Short sessions are there because there are various ways that sessions could be compromised. You haven't actually addressed either of the author's points, though. Namely: 1: A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal. 2: The vast majority of ways to compromise a session already give you access far beyond that session itself…

While security and usability are in some sense opposite poles of a continuum, it’s not strictly a matter of tradeoffs. It’s easy to imagine a decision that considerably decreases the usability of a system without appreciably increasing its security or even decreasing it.

Re: Short session expiration does not help security

#126

Post by Nemi » Fri, Aug 18, 2023, 3:28 PM UTC

horsawlarway wrote: post #18

klodolph wrote: post #8

> Also, it would be better to protect against this by securing the logs or using hard drive encryption. This one line is emblematic of the flaws in the article. My take on the article is, “Imagine that everything else in a system is done correctly, and the system, overall, is perfectly secure. In this imaginary world, short sessions don’t help.” One fact about security which you cannot avoid is that any one particula…

> Short sessions are there because there are various ways that sessions could be compromised. You haven't actually addressed either of the author's points, though. Namely: 1: A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal. 2: The vast majority of ways to compromise a session already give you access far beyond that session itself…

I couldn’t agree more. Security is almost always user hostile (speaking from a UX perspective). I am NOT advocating that we remove security for obvious reasons (a hacked app is also user hostile). HOWEVER - if we can just acknowledge that security is antithetical to an easy to use, user friendly app then we can make appropriate decisions moving forward.

One of my favorite sayings is “if you are not careful, you are going to secure yourself right out of business”. Ease of use is a real thing, and if you don’t figure out a way to make a secure app that is also very easy to use, someone else will and your pleas of “but it is not secure” are going to fall on deaf ears.

Honestly, baseline security is part of “essential complexity” https://ferd.ca/complexity-has-to-live-somewhere.html. Essential complexity can’t be removed, but it CAN be moved around. Right now we are talking about the essential complexity of managing security through managing a user’s session length. The advocated solution is to make sessions short so that they expire quickly. This seems to remove all “accidental complexity” so that we are only dealing with the essential complexity. But this is misleading. There is still complexity in juggling those short sessions. As a designer you think this solution is simple, but what you have done is moved that essential complexity over to your users. THEY must now manage the impact of short sessions. The complexity does not go away, you just moved it to your users, hence it is user hostile.

The trick then, if making the best product is important to you, is to figure out a way of letting users have long sessions but managing it on your side. This seems to argue that you are making your system more complex by adding accidental complexity (which is generally a bad thing). But really what you are doing is moving some essential complexity away from your users onto you. You lower their burden. This is how you make competitive applications.

Re: Short session expiration does not help security

#127

Post by eclipticplane » Fri, Aug 18, 2023, 3:29 PM UTC

irrational wrote: post #53

I use one website semi regularly that has what feels like a 5 minute session expiration, but is actually probably 10 minutes. The session expires even if you are actively using it. Drives me nuts. But not nuts enough to write in and complain. Maybe I should send them this article ;-)

Is it... American Express? It's the only site that will log me out _while trying to pay my bill_. And forget trying to use American Express Travel.

I have written in to complain, but have only gotten "It's for security reasons" hand waving in reply.

Re: Short session expiration does not help security

#128

Post by GoblinSlayer » Fri, Aug 18, 2023, 3:29 PM UTC

ideksec wrote: post #29

This article makes so many unfounded assumptions in order to make a point. > Presumably they are going to immediately make themselves admin, or wire all your bitcoin to their account. Attackers running scams like a sophisticated BEC will lay dormant for long stretches of time to gather information before acting. Sure, they can export the emails and set up auto-forward rules to maintain visibility when the session exp…

If the attackers control user machine they will have as much information as the user anyway.

Re: Short session expiration does not help security

#129

Post by konschubert » Fri, Aug 18, 2023, 3:30 PM UTC

klodolph wrote: post #74

onetimeuse92304 wrote: post #52

In real world, security is done by a bunch of nearly clueless people hoping to put enough hard enough roadblocks to make it practically not worthwhile for you to hack in. If you don't have mathematically secure solutions, session expiration and similar are the imperfect tools you use to solve your problem. One beef I have with short session expiration, though, is that in many cases it causes people to degrade securit…

> One beef I have with short session expiration, though, is that in many cases it causes people to degrade security. One counterpoint—if sessions last too long, then I forget the password, and reset the password. If sessions are too short, then I choose an insecure password. Neither option is great for security! Talking about systems for which a password manager doesn’t make sense, like your lock screen password.

If you're remembering your passwords then you are probably using insecure passwords or are re-using passwords across multiple services.

Re: Short session expiration does not help security

#130

Post by GoblinSlayer » Fri, Aug 18, 2023, 3:33 PM UTC

klodolph wrote: post #74

onetimeuse92304 wrote: post #52

In real world, security is done by a bunch of nearly clueless people hoping to put enough hard enough roadblocks to make it practically not worthwhile for you to hack in. If you don't have mathematically secure solutions, session expiration and similar are the imperfect tools you use to solve your problem. One beef I have with short session expiration, though, is that in many cases it causes people to degrade securit…

> One beef I have with short session expiration, though, is that in many cases it causes people to degrade security. One counterpoint—if sessions last too long, then I forget the password, and reset the password. If sessions are too short, then I choose an insecure password. Neither option is great for security! Talking about systems for which a password manager doesn’t make sense, like your lock screen password.

What you don't like in the first option? If you need password reset feature, then it's necessary. If you don't need it, then remove it.