Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Short session expiration does not help security

sjoerdlangkemper.nl

Post reply on HN
Print view View original

391–400 of 434 posts

Re: Short session expiration does not help security

#391

Post by MattPalmer1086 »

markhahn wrote: post #212
MattPalmer1086 wrote: post #23

Earlier quoted context omitted.

> This attitude is cancer. Let me throw another quote at you Nonsense, defence in depth is a core security principle. You should not rely on a single control to protect you.

Really, the issue here is that security is never treated quantitatively. At least in my experience - are there examples of quantitative security? In some sense, the problem is that the goal is zero controls breaking, but of course, that also provides no information on security. Intuitively, it would seem that parameterizing security (in a diagnostically useful way) would also require a number of quite different measu…

The closest security generally gets to "quantitative" techniques is in applying risk management to threat models.

But the way risk is managed in the industry (multiplying likelihood and impact) is completely incoherent and voodoo. See the book "How to Measure Anything in Cybersecurity Risk" [1] for a good explanation of why it doesn't work and better ways to do it.

Which is a long way of saying, no, security doesn't use quantitative techniques mostly, but it would be possible if people understood how to measure and manage risk properly.

[1] https://onlinelibrary.wiley.com/doi/book/10.1002/97811198923...

Re: Short session expiration does not help security

#392

Post by derangedHorse »

skinner927 wrote: post #236
jedberg wrote: post #162

They way I like to handle session tokens that seems like a good compromise between security and user friendliness: Automatically renew the token as long as the user is actively using the website. I usually use a 12 hour token and renew if it's 8 hours old or more. The renewal requires the use a second token stored locally in the browser so even if you somehow sniff the token off the wire, you still can't renew it wit…

Do you sign a request with that reauth token or do you send the reauth token? Because if they’re getting mitm then all is lost. How long does the reauth token last for? Is a new one issued when you reauth? As negative as I sound, the system is better than just allowing the regular api token to extend the session. Of the hundreds to thousands of api requests a regular user may make a day, only 1 is the reauth, which i…

With mitm everything is lost. I could just wait until the user gets a reauth token again, assuming the reauth token expires (which it always should). Netflix had an issue a couple years back where sessions would never expire and you could use Netflix for years with the same session cookie.

Re: Short session expiration does not help security

#393

Post by dgoldstein0 »

sangnoir wrote: post #383
labster wrote: post #331

Earlier quoted context omitted.

The USA was distrustful of national ID cards decades before the current level of hyperpartisan rancor. We just don’t the government enough to let them track us everywhere. Not that the current climate helps. The REAL ID Act of 2005 has been delayed so many times, now to 2025. Maybe we should just repeal it instead.

> The REAL ID Act of 2005 has been delayed so many times, now to 2025 Can one fly without a REAL-ID-compliant license or ID?

Yes, with a passport you can

... Probably not what you were trying to ask. I thought the deadline passed for using real ID for TSA but I haven't looked for that info in years

Re: Short session expiration does not help security

#394

Post by marcus0x62 »

dgoldstein0 wrote: post #393
sangnoir wrote: post #383

Earlier quoted context omitted.

> The REAL ID Act of 2005 has been delayed so many times, now to 2025 Can one fly without a REAL-ID-compliant license or ID?

Yes, with a passport you can ... Probably not what you were trying to ask. I thought the deadline passed for using real ID for TSA but I haven't looked for that info in years

The deadline has been pushed to May 7, 2025.

Re: Short session expiration does not help security

#396

Post by ShrigmaMale »

throwawaaarrgh wrote: post #147

Session authentication tokens are effectively a form of credential. Best practice is to expire all credentials after a certain amount of time, because you cannot know for sure all the ways this credential might be compromised or when. It does mitigate risk to reduce the time window in which an attack is feasible / when the attacker might get the credential, and when they might start their attack. Just because you ass…

CIA. yeeting people out of their shit every ten minutes cripples availability, we gotta balance. like most things where the person making the call is not the person who deals with it, security ppl are often too aggressive about killing session duration.

Re: Short session expiration does not help security

#398

Post by ndriscoll »

greedo wrote: post #108
marcosdumay wrote: post #69

Earlier quoted context omitted.

As the GP said, the attitude is cancer, and spreading is what it does. It really doesn't help that "security expert" is a job title. That means this person is expected to deal with security, not business objectives, and will be blamed for security incidents, not business goals satisfied. If the OP's attitude is cancer, this is what causes it, and it's completely toxic.

Exactly. Anyone working in a moderately large company (500+ employees) or in a regulated industry is familiar with this issue. Just as no politician wants to be seen as soft on crime, no CISO want's to be blamed for a security breach. So more and more security gets piled on to every process and application. MFA everywhere, even though you're required to use MFA for the VPN. SSO everywhere, because why not. Session ex…

What do you have against SSO everywhere? I see it as actually one of the things that makes obvious sense. It makes the user's life easier and improves security. It makes it easy to give a new employee access to a bunch of systems at once using RBAC. That and putting users' SSH public keys in LDAP and using that for auth everywhere instead of passwords are two obvious pure wins to me.

Re: Short session expiration does not help security

#399

Post by photonerd »

labster wrote: post #331
williamcotton wrote: post #303

Earlier quoted context omitted.

I’m so envious of the Baltic’s use of technology at the institutional level. It seems literally infeasible for the United States to have state-issued PKI. It’s a meta-partisan issue: no side trusts the other to manage crypto or computer systems. So for example instead of a public many-to-many digital publishing platform we are stuck with the whims of grown men who want to fist fight each other in the Colosseum and al…

The USA was distrustful of national ID cards decades before the current level of hyperpartisan rancor. We just don’t the government enough to let them track us everywhere. Not that the current climate helps. The REAL ID Act of 2005 has been delayed so many times, now to 2025. Maybe we should just repeal it instead.

> We just don’t the government enough to let them track us everywhere.

Eh, that’s the pseudo-libertarian objection (which is… dumb as bricks, practically speaking) but the most common objection is one of access.

Until IDs are both free AND easy to obtain in the US (if you think they are, congrats: you’re in the lucky group) then a national id scheme will always be a non-starter.

IDs face the same problem voting has in recent years (and historically): the systems of power use limiting access as a tool to control those they don’t like.

Re: Short session expiration does not help security

#400

Post by photonerd »

matheusmoreira wrote: post #373
hahn-kev wrote: post #372

Earlier quoted context omitted.

Except our only solution to this problem today IS government provided already (ID SSN or Passport).

Which is dehumanizing. We are not cattle to be identified and marked.

Ah so you are the man with no name, I assume?
Post reply on HN