Short session expiration does not help security • Hacker News Board

Re: Short session expiration does not help security

#381

Post by Too » Sat, Aug 19, 2023, 5:46 AM UTC

paulddraper wrote: post #191

ilyt wrote: post #164

Earlier quoted context omitted.

Stolen hard drive is rarely what you defend from, and arguably might completely not matter if say their short lived session is dead but long-lived password manager one is up. Exploits owning software on machine are far more common than machine itself being stolen. I'd also argue that tying re-login to the sensitive actions is far better way to fight it. Basically have long session for nondestructive actions but short…

Stolen hard drive = Stolen laptop/phone/tablet

Or decommissioned drives.

I’ve seen businesses put used laptops straight up on second hand market, without barely doing basic formatting of the drives, unencrypted. Even less so on private market.

Heard from security friends also that there are examples of attacks that succeeded thanks to drives found in trash outside enterprise.

Re: Short session expiration does not help security

#382

Post by raffraffraff » Sat, Aug 19, 2023, 5:54 AM UTC

matheusmoreira wrote: post #373

hahn-kev wrote: post #372

Earlier quoted context omitted.

Except our only solution to this problem today IS government provided already (ID SSN or Passport).

Which is dehumanizing. We are not cattle to be identified and marked.

Interesting. How do you identify criminals. Or for that matter, how do you identify anyone? "Just don't" or ... Some other solution?

Re: Short session expiration does not help security

#383

Post by sangnoir » Sat, Aug 19, 2023, 6:19 AM UTC

labster wrote: post #331

williamcotton wrote: post #303

Earlier quoted context omitted.

I’m so envious of the Baltic’s use of technology at the institutional level. It seems literally infeasible for the United States to have state-issued PKI. It’s a meta-partisan issue: no side trusts the other to manage crypto or computer systems. So for example instead of a public many-to-many digital publishing platform we are stuck with the whims of grown men who want to fist fight each other in the Colosseum and al…

The USA was distrustful of national ID cards decades before the current level of hyperpartisan rancor. We just don’t the government enough to let them track us everywhere. Not that the current climate helps. The REAL ID Act of 2005 has been delayed so many times, now to 2025. Maybe we should just repeal it instead.

> The REAL ID Act of 2005 has been delayed so many times, now to 2025

Can one fly without a REAL-ID-compliant license or ID?

Re: Short session expiration does not help security

#384

Post by raffraffraff » Sat, Aug 19, 2023, 6:50 AM UTC

paulmooreparks wrote: post #349

My favorite example of putting security ahead of usability: "Unexpected item in bagging area. Please remove item from bagging area." "Item removed from bagging area. Please wait: an attendant will be with you shortly." This one sets me off because I worked in the self-checkout division. The simplest way for stores to improve customer satisfaction and increase usage of self-checkout was to disable the bagging scale an…

It depends on the system, but I've seen the weight system work consistently well in one store chain and fail on every other item in another store chain. Perhaps there's a leniency configuration, and some stores set it to "ultra, ultra paranoid" mode?

Re: Short session expiration does not help security

#385

Post by duggan » Sat, Aug 19, 2023, 7:03 AM UTC

raffraffraff wrote: post #382

matheusmoreira wrote: post #373

Earlier quoted context omitted.

Which is dehumanizing. We are not cattle to be identified and marked.

Interesting. How do you identify criminals. Or for that matter, how do you identify anyone? "Just don't" or ... Some other solution?

I assume their version involves another individual unaffiliated with government or private industry taking their hand, gazing meaningfully into their eyes, and tearfully proclaiming “I see you” before letting them through the border or into the bank vault or whatever.

Re: Short session expiration does not help security

#386

Post by graftak » Sat, Aug 19, 2023, 7:41 AM UTC

chongli wrote: post #321

Nextgrid wrote: post #21

In a lot of cases, short session expiry is used as a hack around subpar authentication standards such as SAML/OIDC where there is no reliable backchannel for the identity provider to tell the service to expire sessions (following a credential change, user being deleted, etc). The short session expiry is used as a workaround to force the third-party service to regularly check-in with the identity provider, thus placin…

How would those other technologies deal with the situation where grandma signs into her banking account via app on her phone and then gets distracted, leaving her phone unlocked on the table for teenage Jimmy to find? My bank uses short sessions so I get signed out within a few minutes of inactivity. Long sessions would seem to leave grandma wide open to this sort of local attack.

By asking for credentials/auth for every meaningful interaction.

Re: Short session expiration does not help security

#387

Post by paulddraper » Sat, Aug 19, 2023, 7:42 AM UTC

gregopet wrote: post #302

paulddraper wrote: post #144

> Perhaps you used the shared computer in the library to access your web application, and forgot to log out. > Is this a thing? Are shared computers without user separation a thing? If so, these shouldn’t be used to access web applications with sensitive information at all. Yes, it is a thing. I understand you would like it to not be a thing.

Even if it is a thing - after using a shared computer one MUST log out. If the 15 minute expiration time saved you then you're just damned lucky!

I have a feeling a lot of people get "lucky" a lot.

Re: Short session expiration does not help security

#388

Post by megous » Sat, Aug 19, 2023, 8:05 AM UTC

actuallyalys wrote: post #186

The main place I see short session expirations is on banking and financial apps, which seems defensible to me for a couple of reasons: 1) They're used by a wide variety of people, including people who may not own a computer or mobile device, or who may not have a backup device to use when their personal device breaks. This group is probably shrinking—more and more people have smartphones and the remaining people who…

Smartphone sounds like the worst device you can use for banking.

If remotely compromised, the attecker gets everything they need. The SMS second factor, the user's password, access to user's network, and the user's behavior profile to know when to execute the attack so that they get as much time for it as possible.

Re: Short session expiration does not help security

#389

Post by caskstrength » Sat, Aug 19, 2023, 8:18 AM UTC

megous wrote: post #388

actuallyalys wrote: post #186

The main place I see short session expirations is on banking and financial apps, which seems defensible to me for a couple of reasons: 1) They're used by a wide variety of people, including people who may not own a computer or mobile device, or who may not have a backup device to use when their personal device breaks. This group is probably shrinking—more and more people have smartphones and the remaining people who…

Smartphone sounds like the worst device you can use for banking. If remotely compromised, the attecker gets everything they need. The SMS second factor, the user's password, access to user's network, and the user's behavior profile to know when to execute the attack so that they get as much time for it as possible.

On the other hand I would assume that modern smartphones from manufacturers that care about security to some degree are much harder to compromise compared to random Windows laptops.

Re: Short session expiration does not help security

#390

Post by josefx » Sat, Aug 19, 2023, 8:19 AM UTC

actuallyalys wrote: post #186

The main place I see short session expirations is on banking and financial apps, which seems defensible to me for a couple of reasons: 1) They're used by a wide variety of people, including people who may not own a computer or mobile device, or who may not have a backup device to use when their personal device breaks. This group is probably shrinking—more and more people have smartphones and the remaining people who…

> but it seems like the annoyance in these situations is potentially worth the security benefits.

I would be happy if there was a way to just request a long session for that. No need to force everything into a short session just because it is a sensible default.