Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Short session expiration does not help security

sjoerdlangkemper.nl

Post reply on HN
Print view View original

191–200 of 434 posts

Re: Short session expiration does not help security

#191

Post by paulddraper »

ilyt wrote: post #164
paulddraper wrote: post #155

Earlier quoted context omitted.

> A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal. Why "usually does not"? The stolen hard drive, leaked data, etc. can happen at any point in the future....one minute to one year from now. For most of those times, a short session will prevent the attacker from exploiting it. > The vast majority of ways to compromise a session al…

Stolen hard drive is rarely what you defend from, and arguably might completely not matter if say their short lived session is dead but long-lived password manager one is up. Exploits owning software on machine are far more common than machine itself being stolen. I'd also argue that tying re-login to the sensitive actions is far better way to fight it. Basically have long session for nondestructive actions but short…

Stolen hard drive = Stolen laptop/phone/tablet

Re: Short session expiration does not help security

#192

Post by cortesoft »

horsawlarway wrote: post #18
klodolph wrote: post #8

> Also, it would be better to protect against this by securing the logs or using hard drive encryption. This one line is emblematic of the flaws in the article. My take on the article is, “Imagine that everything else in a system is done correctly, and the system, overall, is perfectly secure. In this imaginary world, short sessions don’t help.” One fact about security which you cannot avoid is that any one particula…

> Short sessions are there because there are various ways that sessions could be compromised. You haven't actually addressed either of the author's points, though. Namely: 1: A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal. 2: The vast majority of ways to compromise a session already give you access far beyond that session itself…

> You haven't actually addressed either of the author's points, though. Namely: 1: A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal.

The worst hack at a company I worked for was caused because an old server that was supposed to be decommissioned was left plugged in and connected to the network… a good time later, a hacker exploited a vulnerability in an unpatched package on the machine and got in (since the server was supposed to be decommissioned it was not patched when the rest of the machines were patched).

The hacker used old credentials on the machine to gain access to other machines in our network. If we had been rotating credentials more often, this would not have happened.

We had systems in place to patch and maintain our machines, but once the machine got lost in our inventory management system, it was forgotten about. It wasn’t monitored anymore, and other protections lapsed.

This category of exploit is prevented by credential rotation, because this type of exploit is only possible if a system is neglected.

Re: Short session expiration does not help security

#193

Post by nottorp »

WhitneyLand wrote: post #89

This one seems prone to bias. Out of all the people disagreeing in the comments who actually takes a position against self interest? 1) Security is more your focus than UX, but you agree with the article. 2) UX is more your focus than security, but you disagree with the article.

What's security and what's security theater?

Is XSS a fact of life that needs to be protected against or a fundamental flaw of the protocols we currently use that could be fixed at the root if it didn't make web development more expensive/inconvenient?

Re: Short session expiration does not help security

#194

Post by pxc »

jameshart wrote: post #83
horsawlarway wrote: post #18

Earlier quoted context omitted.

> Short sessions are there because there are various ways that sessions could be compromised. You haven't actually addressed either of the author's points, though. Namely: 1: A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal. 2: The vast majority of ways to compromise a session already give you access far beyond that session itself…

> This attitude is cancer > yes really - fucking always You're really angry with that straw man you've stood up. The OP isn't saying systems have to be locked down to the extent that they're useless. Who would ever argue for such a thing? Note that "You don't stop securing it just because you've found one good option" is NOT the same thing as saying "You don't stop securing it until you've closed every possible secur…

> Note that "You don't stop securing it just because you've found one good option" is NOT the same thing as saying "You don't stop securing it until you've closed every possible security gap and compromised usability".

It seems to me that 'defense-in-depth' can very easily become a mantra that inevitably means drifting towards the latter. What are the real guidelines for telling when enough is enough? Because ime people who even can articulate anything along those lines are way, way fewer than people who make appeals to defense-in-depth.

And I think this is part of the problem: without a principled way to assess what is gratuitous, repeated appeals to defense-in-depth will lead to security practices that heavily favor having more measures in place over having a good UX. This is because the environments where information security is most valued are already organizations that frankly, do not give a shit about UX. The customers for cybersecurity products are massive bureaucracies: large enterprises, governments, and militaries. The vendors that sell those products are embedded in a broader market where no software really has to be usable, because there's a fundamental disconnect between the purchasing decision and the use of the software. For all B2B software, the user is not the customer, and it shows in a thousand ways. In infosec things are further tilted in that lots of easy routes to compliance which are terrible for UX are falsely perceived and presented as strictly required, perhaps even by law.

The idea that in a B2B market which primarily serves large organizations and governments, you will get any organic weighing and balancing of security against usability 'for free' is sheer fantasy. So where is the real counterweight to the advice that on its own recommends 'always add more, unless you have good reason not to'?

Re: Short session expiration does not help security

#195

Post by horsawlarway »

recursive wrote: post #145
horsawlarway wrote: post #115

Earlier quoted context omitted.

Yes. Literally. I would say it makes an excellent analogy: A part of the whole (security) is prioritizing themselves and their needs in a way that makes the overall organism much less capable and effective. Cancer.

Still metaphorical cancer.

Not according to the definitions of those words that I can see

Metaphor: a figure of speech in which a word or phrase is applied to an object or action to which it is not literally applicable.

Cancer: a practice or phenomenon perceived to be evil or destructive and hard to contain or eradicate.

My usage is literal. Organizations that act this way have cancer. They suffer from it, they can be treated, they can die.

It's as real as it gets. I am using cancer in the body as an analogy for this form of cancer - but I am not using a metaphor.

Re: Short session expiration does not help security

#196

Post by nottorp »

gabereiser wrote: post #36

Neither does “Your password cannot match your previous 1,000 passwords”. Let’s just keep everyone’s password and previous password around in a database shall we?

It's easy. Make your password CorrectHorseBatteryStaple000. Increment until 999. Rotate.

Re: Short session expiration does not help security

#197

Post by grishka »

Zetice wrote: post #184
grishka wrote: post #180

ANY session expiration does not help security. Authentication should not involve time. If I logged in, I should stay logged in until I explicitly log out. That's it. The session should live forever or at least several years from the last time I used it. Speaking of internet cafes and other shared computers, they usually are secure enough. All internet cafes I've ever been to run specialized management software on the…

This is an insane take; if your session token is buried somewhere in a log and gets discovered after a few hours, it shouldn't even be remotely possible that it's still valid.

A few HOURS? That's an insane take.

What kind of situation makes that possible even?

Re: Short session expiration does not help security

#198

Post by grishka »

sneak wrote: post #156
logicalmonster wrote: post #148

Just to play Devil's Advocate, short sessions may actually end up being far less secure when you consider that humans are flawed. If you force people to log in to a system very frequently, they might get lax with security and do dumb things like stick "post-it notes" to their monitors with their login info out of frustration.

Device malware, which is common, can't steal those.

But a keylogger has a better chance of stealing the password if the user has to enter it more frequently.

Re: Short session expiration does not help security

#199

Post by gbear605 »

horsawlarway wrote: post #93
cogman10 wrote: post #73

Earlier quoted context omitted.

> A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal. I'm a bank robber, I want to steal your money without you knowing so I'm not caught. What would be a better way to do that? Withdraw $1000 immediately or to spread out that withdrawal over several months. A short token forces the $1000 withdraw immediately. And one common way the…

This is just wrong on so many levels. > A short token forces the $1000 withdraw immediately. No, a short token forces the attacker to continue making requests, but otherwise places very few limits on what they can do with it (since these tokens are almost always something like "15 minutes since the last use") > In your ship analogy, that's adding a second hull, putting airtight sections between hull locations, and ha…

> since these tokens are almost always something like "15 minutes since the last use"

No? They’re almost always “15 minutes since the last use, or 5 hours since it was created”, which results in a completely different security picture.

Re: Short session expiration does not help security

#200

Post by lelanthran »

klodolph wrote: post #8

> Also, it would be better to protect against this by securing the logs or using hard drive encryption. This one line is emblematic of the flaws in the article. My take on the article is, “Imagine that everything else in a system is done correctly, and the system, overall, is perfectly secure. In this imaginary world, short sessions don’t help.” One fact about security which you cannot avoid is that any one particula…

> “Imagine that everything else in a system is done correctly, and the system, overall, is perfectly secure. In this imaginary world, short sessions don’t help.”

Isn't the reverse also true?

Imagine that everything else in a system is done incorrectly, and the system, overall, is completely insecure. In this imaginary world, short sessions don’t help.

At any point between "perfectly secured system" and "completely borked security in every single layer", in what way will short sessions help?

If you've got a good and secure setup, with maybe one or two holes you don't know about, how does a short session help?

Post reply on HN