Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Short session expiration does not help security

sjoerdlangkemper.nl

Post reply on HN
Print view View original

331–340 of 434 posts

Re: Short session expiration does not help security

#331

Post by labster »

williamcotton wrote: post #303
ljm wrote: post #286

Earlier quoted context omitted.

My main bank uses username + password + (random subset of ‘memorable word but actually unencrypted password’ driven by select boxes), then 2FA on top, and it literally feels like they just slapped a bunch of things together to add extra barriers to auth in sequence. This is the UK. Back in Latvia I would just slide my ID card into a USB reader and cryptographically sign the session with a passcode. Same as chip & pin…

I’m so envious of the Baltic’s use of technology at the institutional level. It seems literally infeasible for the United States to have state-issued PKI. It’s a meta-partisan issue: no side trusts the other to manage crypto or computer systems. So for example instead of a public many-to-many digital publishing platform we are stuck with the whims of grown men who want to fist fight each other in the Colosseum and al…

The USA was distrustful of national ID cards decades before the current level of hyperpartisan rancor. We just don’t the government enough to let them track us everywhere.

Not that the current climate helps. The REAL ID Act of 2005 has been delayed so many times, now to 2025. Maybe we should just repeal it instead.

Re: Short session expiration does not help security

#332

Post by water9 »

hutzlibu wrote: post #75
water9 wrote: post #55

Earlier quoted context omitted.

Don’t prioritize security if the root cause of the security breach is someone is getting access to the session tokens not that the server session tokens are arbitrarily too long. that attack might happen once ever and it doesn’t really matter if they have five or 10 minutes you’re still screwed because they can just go get another session token next time and be prepared. Optimize the application to run the best for a…

"Optimize the application to run the best for all the users first and then adjust the security implementation as necessary. Otherwise, you could DoS yourself by trying to be too secure. " I think it depends what kind of buisness you are running and what a security breach means for you or your users. If it is a hobby forum, well yes, UX matters more. But if you screwed up security for anything with big money related -…

Zero days exist almost every day and there there’s nothing you can do about it. So make sure that what they steal if they do steal anything is a bunch of encrypted envelopes instead of raw pictures.

Re: Short session expiration does not help security

#333

Post by diroussel »

jrockway wrote: post #318
ljm wrote: post #286

Earlier quoted context omitted.

My main bank uses username + password + (random subset of ‘memorable word but actually unencrypted password’ driven by select boxes), then 2FA on top, and it literally feels like they just slapped a bunch of things together to add extra barriers to auth in sequence. This is the UK. Back in Latvia I would just slide my ID card into a USB reader and cryptographically sign the session with a passcode. Same as chip & pin…

> Back in Latvia I would just slide my ID card into a USB reader and cryptographically sign the session with a passcode. I think this is a good authentication model, but it costs money. There is the upfront cost of the physical card, and then the higher cost of lost account recovery. I think that's the turn-off to most banks; they will have to staff a call center that can verify your ID, issue a new card, and then de…

In Norway, Latvia, Belgium and probably others, the card is issued by the government. So there is no cost to the bank to re-issue a lost card.

Re: Short session expiration does not help security

#334

Post by plorntus »

illusiveman wrote: post #329
plorntus wrote: post #307

Earlier quoted context omitted.

Spains banks (I’ve used two so far) simply use your ID number which is used in a lot of places and not considered secret and enforces a 4 digit password. It’s an absolute joke.

I wondered once about this, but it kind of make sense from the point of view of usability. Unlike any webservice, you usually have very few attempts to make a successful login before getting locked out, so even if it's four digits, the odds of a successful brute force attack are very low

I suppose so, I just find it funny really that my bank has less password requirements than most (if not all) online services I use

Re: Short session expiration does not help security

#335

Post by actuallyalys »

Fatnino wrote: post #320
actuallyalys wrote: post #186

The main place I see short session expirations is on banking and financial apps, which seems defensible to me for a couple of reasons: 1) They're used by a wide variety of people, including people who may not own a computer or mobile device, or who may not have a backup device to use when their personal device breaks. This group is probably shrinking—more and more people have smartphones and the remaining people who…

There is a class of people who feel a smartphone is too much of a distraction to carry around all the time. They will carry around a flip phone that can do basically nothing beyond calls, sms, and camera. These are otherwise perfectly normal members of society with bank accounts. I don't know how common these people are. I happen to know a handful of them but I probably don't travel in typical circles.

In case it wasn't clear, I didn't meant to disparage people without phones or computers (or for that matter, people without bank accounts), just to note they are a small group of people and shrinking.

Re: Short session expiration does not help security

#336

Post by 1vuio0pswjnm7 »

"That being said, I don't know if short session expiration is the best solution in 2023. As the article points out, major corporations like Google don't use short sessions, even though their services are used for a variety of sensitive things and they're huge targets."

Is it possible that Google might prefer that users stay "logged in" because this allows Google to conduct more data collection, for purposes of supporting its online advertising services business. Perhaps staying logged in is "more secure" for the ad targets that use Google than logging out. Maybe its both, but not in equal measure. Which one would be more important to Google and its shareholders. Would a company like Google make tradeoffs that favour its bottom line. Are there any differences between the core business of Google (advertising) versus the core business of financial institutions. For example, Google's customers are advertisers. The folks that have Google "accounts" for non-advertising purposes, i.e., probably the majority of folks in the world who have Google accounts, are not customers.

Re: Short session expiration does not help security

#337

Post by [deleted] »

npunt wrote: post #309
actuallyalys wrote: post #186

The main place I see short session expirations is on banking and financial apps, which seems defensible to me for a couple of reasons: 1) They're used by a wide variety of people, including people who may not own a computer or mobile device, or who may not have a backup device to use when their personal device breaks. This group is probably shrinking—more and more people have smartphones and the remaining people who…

Health services also log you out after ~15min. Kaiser, One Medical, Epic Mychart, etc. Very annoying

[deleted]

Re: Short session expiration does not help security

#338

Post by actuallyalys »

npunt wrote: post #309
actuallyalys wrote: post #186

The main place I see short session expirations is on banking and financial apps, which seems defensible to me for a couple of reasons: 1) They're used by a wide variety of people, including people who may not own a computer or mobile device, or who may not have a backup device to use when their personal device breaks. This group is probably shrinking—more and more people have smartphones and the remaining people who…

Health services also log you out after ~15min. Kaiser, One Medical, Epic Mychart, etc. Very annoying

I think reasons 1 and 3 I listed for financial apps and websites apply for health services, but 2 and 4 don't, so I see why they do it, even if it's less clear-cut.

Re: Short session expiration does not help security

#339

Post by wredue »

actuallyalys wrote: post #186

The main place I see short session expirations is on banking and financial apps, which seems defensible to me for a couple of reasons: 1) They're used by a wide variety of people, including people who may not own a computer or mobile device, or who may not have a backup device to use when their personal device breaks. This group is probably shrinking—more and more people have smartphones and the remaining people who…

I see pretty short timers in enterprise saas as well. Reason being that having a license for 400 users is much more expensive than a license for 30 users.

Re: Short session expiration does not help security

#340

Post by grishka »

Zetice wrote: post #311
grishka wrote: post #256

Earlier quoted context omitted.

> In a JWT, the token is signed and you validate the signature with a cert, and that cert is public knowledge. JWT is a particular type of token. Not everyone uses JWTs because they have drawbacks — in particular, a self-contained signed token can't be revoked without maintaining some sort of blacklist of invalidated tokens. So you have to resort to expiration to make up for that I guess? In my own backend projects I…

A hacker would start salivating if they heard someone who built a product storing PII said what you just did about session tokens for your personal projects.

And? I assume that my users are smart.

By the way, social media services like Facebook do store PII and have non-expiring sessions. And somehow, if someone's account is hacked, it's that person's problem, not Facebook's.

Post reply on HN