351–360 of 434 posts
If the account is for accessing employer's system then sessions have to be kept short, and users have to re-login every day. Otherwise employees who have left the company would continue to access the system. The reason Google never expires your session is because they want to track your activity and connect your activity to your account. This is not a good system to copy.
If the account is for accessing employer's system then sessions have to be kept short, and users have to re-login every day. Otherwise employees who have left the company would continue to access the system. The reason Google never expires your session is because they want to track your activity and connect your activity to your account. This is not a good system to copy.
My favorite example of putting security ahead of usability: "Unexpected item in bagging area. Please remove item from bagging area." "Item removed from bagging area. Please wait: an attendant will be with you shortly." This one sets me off because I worked in the self-checkout division. The simplest way for stores to improve customer satisfaction and increase usage of self-checkout was to disable the bagging scale an…
Like the Costco receipt checker, it's very unlikely this person will flag anything unless you're suspicious as hell. It's like those "eyes stickers" in Asia - to keep honest people honest.
The main place I see short session expirations is on banking and financial apps, which seems defensible to me for a couple of reasons: 1) They're used by a wide variety of people, including people who may not own a computer or mobile device, or who may not have a backup device to use when their personal device breaks. This group is probably shrinking—more and more people have smartphones and the remaining people who…
Health services also log you out after ~15min. Kaiser, One Medical, Epic Mychart, etc. Very annoying
The main place I see short session expirations is on banking and financial apps, which seems defensible to me for a couple of reasons: 1) They're used by a wide variety of people, including people who may not own a computer or mobile device, or who may not have a backup device to use when their personal device breaks. This group is probably shrinking—more and more people have smartphones and the remaining people who…
As the developer, I really didn't want to add it, but who cares what I want.
I’m looking at you
- Sudoless single-user machine users
- VPNs
- AVs on servers
- Disabled ports
- Disabled ota protocols
- etc
The main place I see short session expirations is on banking and financial apps, which seems defensible to me for a couple of reasons: 1) They're used by a wide variety of people, including people who may not own a computer or mobile device, or who may not have a backup device to use when their personal device breaks. This group is probably shrinking—more and more people have smartphones and the remaining people who…
Training people to always login makes the susceptible to phishing attacks with fake logins. It becomes second nature to put in your email and password. Whats even worst is that banks won't send messages over email instead they make you sign into their "Secure" message center. Some how email is insecure but sending the same info in a physical mailing is safer. Any time you select electronic statements instead of physi…
The main place I see short session expirations is on banking and financial apps, which seems defensible to me for a couple of reasons: 1) They're used by a wide variety of people, including people who may not own a computer or mobile device, or who may not have a backup device to use when their personal device breaks. This group is probably shrinking—more and more people have smartphones and the remaining people who…
My main bank uses username + password + (random subset of ‘memorable word but actually unencrypted password’ driven by select boxes), then 2FA on top, and it literally feels like they just slapped a bunch of things together to add extra barriers to auth in sequence. This is the UK. Back in Latvia I would just slide my ID card into a USB reader and cryptographically sign the session with a passcode. Same as chip & pin…
This annoys me so much with my bank. Their app lets you enroll your account into Face ID authentication, then still ask one of the recovery questions every time.
The UX is awful. I'm so convinced that complaining anywhere won't actually help so I don't bother.
I'd love to know what the hypothetical attack scenario is that drove that decision, but I suspect there isn't one, and the app saves the username/password in encrypted device storage.
Earlier quoted context omitted.
My main bank uses username + password + (random subset of ‘memorable word but actually unencrypted password’ driven by select boxes), then 2FA on top, and it literally feels like they just slapped a bunch of things together to add extra barriers to auth in sequence. This is the UK. Back in Latvia I would just slide my ID card into a USB reader and cryptographically sign the session with a passcode. Same as chip & pin…
> random subset of ‘memorable word but actually unencrypted password’ This annoys me so much with my bank. Their app lets you enroll your account into Face ID authentication, then still ask one of the recovery questions every time. The UX is awful. I'm so convinced that complaining anywhere won't actually help so I don't bother. I'd love to know what the hypothetical attack scenario is that drove that decision, but I…