Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Short session expiration does not help security

sjoerdlangkemper.nl

Post reply on HN
Print view View original

201–210 of 434 posts

Re: Short session expiration does not help security

#201

Post by lelanthran »

horsawlarway wrote: post #95
generalizations wrote: post #90

Earlier quoted context omitted.

The point is that it's a really bad tradeoff, because the impact to the users is high, and the impact to security is low. And yet we do it, because "You don't stop securing it just because you've found one good option", and that's a really bad reason to improve security by such a small increment with such large negative consequences. The problem with 'defense in depth' is that it comes as close as possible to locking…

Ding ding ding! If you want to defend in depth - more power to you. If the way you're "defending in depth" is mostly not adding security, and is actively making the product less useful... I'm going to call it shite. If you blindly say "defend in depth" without actually... you know... evaluating what that defense does to the product as a whole, you're doing your job poorly.

> Ding ding ding!

> If you want to defend in depth - more power to you.

> If the way you're "defending in depth" is mostly not adding security, and is actively making the product less useful... I'm going to call it shite.

Agreed. Sure, there is defense at different depths, but there's no reason to add depth without adding defense as well.

Re: Short session expiration does not help security

#202

Post by hannasanarion »

horsawlarway wrote: post #138
cuu508 wrote: post #82

Earlier quoted context omitted.

Let's say the bank also uses 2FA (say, physical code calculators) - your next step?

Install system malware - wait for next login (which will be soon, since the short session is forcing repeated logins) send session token to myself. Done. Now I have an active session. Don't give a fuuuuck about that 2fa device.

This is a bit like saying, "there's no point in having a lock on my door because somebody in my house can shoot me". The fact that an outer ring of security can't protect you from people who are already in an inner ring doesn't invalidate the outer ring.

If you already own somebody enough to install whatever malware you want on their computer, then sure, session lengths aren't going to stop you, but they're also not intended to. Session lengths are intended to stop the guy at the coffee shop who grabs your computer when you go to use the bathroom.

Re: Short session expiration does not help security

#203

Post by _jal »

generalizations wrote: post #90
jameshart wrote: post #83

Earlier quoted context omitted.

> This attitude is cancer > yes really - fucking always You're really angry with that straw man you've stood up. The OP isn't saying systems have to be locked down to the extent that they're useless. Who would ever argue for such a thing? Note that "You don't stop securing it just because you've found one good option" is NOT the same thing as saying "You don't stop securing it until you've closed every possible secur…

The point is that it's a really bad tradeoff, because the impact to the users is high, and the impact to security is low. And yet we do it, because "You don't stop securing it just because you've found one good option", and that's a really bad reason to improve security by such a small increment with such large negative consequences. The problem with 'defense in depth' is that it comes as close as possible to locking…

> The problem with 'defense in depth'

No, that's a problem with bad engineering. That a process requires skills most people attempting it don't have isn't a problem with the process, it just means that it is hard and relatively new.

One thing I see all the time that demonstrates this incompetence is talking about something being more or less "secure" without reference to a threat model. You simply can't make reasonable tradeoffs without thinking this through, and yet nobody wants to do the exercise.

In fairness, this is not just an engineering fault. I've seen one case where a legal department freaked out when they heard about a risk analysis project in pursuit of a formal threat model - they vehemently objected to anyone producing documents about such things that could potentially surface in some discovery fight.

Re: Short session expiration does not help security

#204

Post by grishka »

lr4444lr wrote: post #170

Disagree completely. People walking away from public computer terminals, e.g. libraries, are greatly helped by shorter sessions, even if they're imperfect.

This is solved by the "someone else's computer" checkbox in the login form that makes sessions expire. 99% of the time, though, people are using personal devices. 99% of people should not suffer because of the forgetful fraction of the 1% who use shared computers.

Re: Short session expiration does not help security

#205

Post by edejong »

cortesoft wrote: post #192
horsawlarway wrote: post #18

Earlier quoted context omitted.

> Short sessions are there because there are various ways that sessions could be compromised. You haven't actually addressed either of the author's points, though. Namely: 1: A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal. 2: The vast majority of ways to compromise a session already give you access far beyond that session itself…

> You haven't actually addressed either of the author's points, though. Namely: 1: A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal. The worst hack at a company I worked for was caused because an old server that was supposed to be decommissioned was left plugged in and connected to the network… a good time later, a hacker exploite…

It could also have been prevented by… not using user credentials on a server to access services? By doing regular checks on your inventory? By using IDS on your complete network? But not trusting your network? (Zero trust security). By regularly simulating attack scenarios and then check your readiness? By implementing ISO27002?

Re: Short session expiration does not help security

#206

Post by bmurphy1976 »

nine_k wrote: post #163
csydas wrote: post #149

Earlier quoted context omitted.

>There is a cost every time a user has to re-authenticate. There is a cost in resources to handle the extra authentications. There is a cost in complexity to maintain and extend the system doing authentication. I think this is definitely where the security trends in modern IT have gone very awry, as it _is_ extremely annoying to be an end user having to work with modern IT security practices. Off the top of my head:…

> if you have any issues with your alternative authentication devices, you are completely locked out of your work You have printed the rescue codes when prompted, and have put that physical piece of paper into your wallet, haven't you?

That's a nightmare process for any normal user. There's no way the vast majority of people are savvy enough to do this correctly.

Re: Short session expiration does not help security

#207

Post by hannasanarion »

GoblinSlayer wrote: post #128
ideksec wrote: post #29

This article makes so many unfounded assumptions in order to make a point. > Presumably they are going to immediately make themselves admin, or wire all your bitcoin to their account. Attackers running scams like a sophisticated BEC will lay dormant for long stretches of time to gather information before acting. Sure, they can export the emails and set up auto-forward rules to maintain visibility when the session exp…

If the attackers control user machine they will have as much information as the user anyway.

Not if they don't have the passwords and 2FA devices to access company resources from that machine, and all of the sessions are expired.

Re: Short session expiration does not help security

#208

Post by csydas »

paulddraper wrote: post #190
csydas wrote: post #177

Earlier quoted context omitted.

I'm explaining it poorly; think about the urls for common authentication redirects and how it usually looks when you go through an SSO portal. Probably you start at a page like: sso.company.com When you try to access a service, you're taken to probably something like sso.company.com/auth If your company uses Microsoft or Gmail, very likely before you reach your SSO login, it may temporarily flash MS/Google's auth pag…

Some Lastpass admin page redirects me no joke like 10 times.

exactly; if you know what these systems are doing it's easier to be comfortable with it, but it's still very annoying/long for every single login.

and we've done such a good job of training users to detect suspicious behavior, and here we are using the same suspicious behavior that spam sites use, it leaves me with a frustrated feeling.

Re: Short session expiration does not help security

#209

Post by grishka »

8organicbits wrote: post #60
bombcar wrote: post #45

The proper way to handle the problem is to tie session IDs to more than just a cookie or other fixed value; so that if they get exfiltrated they cannot be used without reauthenticating. For example, the Session ID becomes "IP address + session token + browser ID" or something, then if I get your token, and even if I can mimic your browser fingerprint, I'd still have to be coming from your IP.

Careful about doing this. Laptop and phones change networks. If my wifi is weak you'll see my phone switch to data intermittently. Forcing me to re-auth every switch would be painful. Some VPN providers also change IP addresses regularly (I've seen <1 minute between switches).

Also people in countries where the government censors the internet often use VPNs to bypass that censorship, so their IP address might change many times a day, including jumping to a different country. IP addresses should really not be used for anything beyond packet routing.

Re: Short session expiration does not help security

#210

Post by horsawlarway »

jameshart wrote: post #178
horsawlarway wrote: post #95

Earlier quoted context omitted.

Ding ding ding! If you want to defend in depth - more power to you. If the way you're "defending in depth" is mostly not adding security, and is actively making the product less useful... I'm going to call it shite. If you blindly say "defend in depth" without actually... you know... evaluating what that defense does to the product as a whole, you're doing your job poorly.

The rules of engagement on this site call not for radical candor but for taking the most charitable interpretation of someone's words. Maybe the OP wasn't blindly saying 'defend in depth'? Maybe they were advocating for evaluating what that defense does to the product as a whole? If they were, is their attitude worth describing as cancerous?

If that was my entire comment - I'd probably agree with you. Good thing there's about 5 other paragraphs of content in my response that provide additional context...

My take: you're stuck on the word cancer as some sort of insult, rather than an analogy. I'd argue you're being fairly uncharitable in your responses - and further... you're yet again not engaging with the actual on-topic discussion.

Have a good one.

Post reply on HN