Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Short session expiration does not help security

sjoerdlangkemper.nl

Post reply on HN
Print view View original

371–380 of 434 posts

Re: Short session expiration does not help security

#371

Post by Fatnino »

actuallyalys wrote: post #335
Fatnino wrote: post #320

Earlier quoted context omitted.

There is a class of people who feel a smartphone is too much of a distraction to carry around all the time. They will carry around a flip phone that can do basically nothing beyond calls, sms, and camera. These are otherwise perfectly normal members of society with bank accounts. I don't know how common these people are. I happen to know a handful of them but I probably don't travel in typical circles.

In case it wasn't clear, I didn't meant to disparage people without phones or computers (or for that matter, people without bank accounts), just to note they are a small group of people and shrinking.

The people I brought up used to have smartphones and made a conscious decision to go back down the tech tree. So an inflow to the no smartphone group. Certainly not outweighed by the outflow so the group is still shrinking as you state.

Re: Short session expiration does not help security

#372

Post by hahn-kev »

matheusmoreira wrote: post #369
williamcotton wrote: post #303

Earlier quoted context omitted.

I’m so envious of the Baltic’s use of technology at the institutional level. It seems literally infeasible for the United States to have state-issued PKI. It’s a meta-partisan issue: no side trusts the other to manage crypto or computer systems. So for example instead of a public many-to-many digital publishing platform we are stuck with the whims of grown men who want to fist fight each other in the Colosseum and al…

> no side trusts the other to manage crypto or computer systems Nor should they. Too much power for governments to have. Every so often some news gets posted here about some government official who just does not give a shit about people's rights, you can actually feel the contempt when you read what they say. Government solutions are non-solutions. We should solve these problems with ubiquitous technology or not solv…

Except our only solution to this problem today IS government provided already (ID SSN or Passport).

Re: Short session expiration does not help security

#373

Post by matheusmoreira »

hahn-kev wrote: post #372
matheusmoreira wrote: post #369

Earlier quoted context omitted.

> no side trusts the other to manage crypto or computer systems Nor should they. Too much power for governments to have. Every so often some news gets posted here about some government official who just does not give a shit about people's rights, you can actually feel the contempt when you read what they say. Government solutions are non-solutions. We should solve these problems with ubiquitous technology or not solv…

Except our only solution to this problem today IS government provided already (ID SSN or Passport).

Which is dehumanizing. We are not cattle to be identified and marked.

Re: Short session expiration does not help security

#374

Post by jimmydorry »

xp84 wrote: post #347
labster wrote: post #331

Earlier quoted context omitted.

The USA was distrustful of national ID cards decades before the current level of hyperpartisan rancor. We just don’t the government enough to let them track us everywhere. Not that the current climate helps. The REAL ID Act of 2005 has been delayed so many times, now to 2025. Maybe we should just repeal it instead.

> We just don’t the government enough to let them track us everywhere. That statement is both true and emblematic of the problem. Everyone is so cynical that a clean public-key, offline, certificate-based solution, with an absolute zero visibility to the government of who is doing what, would always be assumed to be part of some nefarious Illuminati/Democrat/Republican plot. Proving it to people with technical tests…

Because there has never been a proposal for a "clean public-key / offline / certificate-based solution". It's always a central database that also does x and y and will be available for w and z departments to do as they will with it.

Re: Short session expiration does not help security

#375

Post by hahn-kev »

horsawlarway wrote: post #26
dakial1 wrote: post #19

Earlier quoted context omitted.

The author also puts lot’s of faith on the user not doing stupid things: “Is this a thing? Are shared computers without user separation a thing? If so, these shouldn’t be used to access web applications with sensitive information at all, no matter how short the session expiry time is.” Yeah, users might just leave their bank logged in a open and logged computer library. That’s why short sessions exist for those as th…

> Not perfect of course, but limit the exposure. It's a shared computer (and if the session is carrying over, it's not just shared hardware it's a shared account). In this case - you are utterly fucked if you think that machine is secure. Hell, fuck the session, I'll just run a keylogger (or if I'm not admin, install a malicious browser extension) and capture your whole login - I have considerably more access to this…

Got it, so people who aren't privileged enough to own a device shouldn't use the internet.

Re: Short session expiration does not help security

#376

Post by WhitneyLand »

BeefWellington wrote: post #287
WhitneyLand wrote: post #89

This one seems prone to bias. Out of all the people disagreeing in the comments who actually takes a position against self interest? 1) Security is more your focus than UX, but you agree with the article. 2) UX is more your focus than security, but you disagree with the article.

The mistake is in thinking security is a separate domain from UX. While expertise in it may be, it applies everywhere . To draw a comparison here, should we assume that the author advocates for phones or desktops which do not automatically lock after a set period? It's a similar threat vector (unattended phone/pc) in the physical world. I'd assume no, because the specifics of that threat model are different. This is…

Agree they’re not at odds. I’m not trying to say they’re adversarial at all.

Rather, it’s that I suspect some comparisons are less likely to get objective thinking out of us than others.

Re: Short session expiration does not help security

#377

Post by nickserv »

jrockway wrote: post #362
diroussel wrote: post #333

Earlier quoted context omitted.

In Norway, Latvia, Belgium and probably others, the card is issued by the government. So there is no cost to the bank to re-issue a lost card.

Ah, that's the key. We'd never get a national ID in the US, instead ironically forcing the costly KYC onto each individual bank. (And Twitter now apparently.)

There's already a Federal ID required for banking in the US: your social security number.

Re: Short session expiration does not help security

#378

Post by pxc »

Nemi wrote: post #126
horsawlarway wrote: post #18

Earlier quoted context omitted.

> Short sessions are there because there are various ways that sessions could be compromised. You haven't actually addressed either of the author's points, though. Namely: 1: A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal. 2: The vast majority of ways to compromise a session already give you access far beyond that session itself…

I couldn’t agree more. Security is almost always user hostile (speaking from a UX perspective). I am NOT advocating that we remove security for obvious reasons (a hacked app is also user hostile). HOWEVER - if we can just acknowledge that security is antithetical to an easy to use, user friendly app then we can make appropriate decisions moving forward. One of my favorite sayings is “if you are not careful, you are g…

Is there a term for this kind of thinking, or a type of job role in security that focuses on problems like this? Are there any professional 'strategic rearranger of security complexity' or 'security UX champion' jobs out there?

This seems like it could be a really valuable and maybe also fun role, if one can find an org that has made room for it.

Re: Short session expiration does not help security

#379

Post by mindslight »

xp84 wrote: post #347
labster wrote: post #331

Earlier quoted context omitted.

The USA was distrustful of national ID cards decades before the current level of hyperpartisan rancor. We just don’t the government enough to let them track us everywhere. Not that the current climate helps. The REAL ID Act of 2005 has been delayed so many times, now to 2025. Maybe we should just repeal it instead.

> We just don’t the government enough to let them track us everywhere. That statement is both true and emblematic of the problem. Everyone is so cynical that a clean public-key, offline, certificate-based solution, with an absolute zero visibility to the government of who is doing what, would always be assumed to be part of some nefarious Illuminati/Democrat/Republican plot. Proving it to people with technical tests…

Why are you talking about hypotheticals and abstract "distrust" ? We're already being harmed by existing central ID systems - social security numbers and drivers license numbers - with little hope for reform in sight. If there were something like the GDPR that prohibited companies from nonconsensually demanding, storing, or using these identifiers for anything but their bona fide governmental functions, then it might make sense to talk about adding a new system. But until the government is capable of reigning in abuse of the existing systems, any new identification system would inevitably be a gift to the surveillance companies.

Re: Short session expiration does not help security

#380

Post by pxc »

horsawlarway wrote: post #165
rrrpfb11 wrote: post #137

Earlier quoted context omitted.

> Security is ALWAYS (fucking always, yes really - fucking always) a tradeoff. It’s helpful to me that ACLs prevent me seeing other users’ files. I’m not trading anything off that I’m aware of.

> I’m not trading anything off that I’m aware of. Really? Really???? You're not, say... having to manage ACLs, and having to run a system that can enforce ACLs? Because both of those are tradeoffs. They might be "completely sane and reasonable" tradeoffs! But they are still tradeoffs. Also - in a more blunt way: Simply not being able to see other peoples files was considered a pretty big negative in some computing cr…

> Really? Really???? You're not, say... having to manage ACLs, and having to run a system that can enforce ACLs?

In this case, it's a more user-friendly tradeoff, because those burdens can be borne by the infosec staff and other IT staff rather than end users. I'm happy when I can arrange things that way for my own users for sure.

Post reply on HN