Earlier quoted context omitted.
Spains banks (I’ve used two so far) simply use your ID number which is used in a lot of places and not considered secret and enforces a 4 digit password. It’s an absolute joke.
Bank Of America requires to tell them a 2FA code sent over SMS, when SMS literally says: BofA: DO NOT share this code. We will NEVER call you or text you for it. No, it wasn't scam, seen that process physically visiting a branch on agent's display multiple times.
Short session expiration does not help security
401–410 of 434 posts
Re: Short session expiration does not help security
#402Earlier quoted context omitted.
Which is dehumanizing. We are not cattle to be identified and marked.
Ah so you are the man with no name, I assume?
Re: Short session expiration does not help security
#403Earlier quoted context omitted.
I see pretty short timers in enterprise saas as well. Reason being that having a license for 400 users is much more expensive than a license for 30 users.
Pretty much all SaaS products charge per unique user, not active sessions, so I don’t really understand what point you’re trying to convey.
Re: Short session expiration does not help security
#404Earlier quoted context omitted.
I couldn’t agree more. Security is almost always user hostile (speaking from a UX perspective). I am NOT advocating that we remove security for obvious reasons (a hacked app is also user hostile). HOWEVER - if we can just acknowledge that security is antithetical to an easy to use, user friendly app then we can make appropriate decisions moving forward. One of my favorite sayings is “if you are not careful, you are g…
Is there a term for this kind of thinking, or a type of job role in security that focuses on problems like this? Are there any professional 'strategic rearranger of security complexity' or 'security UX champion' jobs out there? This seems like it could be a really valuable and maybe also fun role, if one can find an org that has made room for it.
Re: Short session expiration does not help security
#405The main place I see short session expirations is on banking and financial apps, which seems defensible to me for a couple of reasons: 1) They're used by a wide variety of people, including people who may not own a computer or mobile device, or who may not have a backup device to use when their personal device breaks. This group is probably shrinking—more and more people have smartphones and the remaining people who…
My main bank uses username + password + (random subset of ‘memorable word but actually unencrypted password’ driven by select boxes), then 2FA on top, and it literally feels like they just slapped a bunch of things together to add extra barriers to auth in sequence. This is the UK. Back in Latvia I would just slide my ID card into a USB reader and cryptographically sign the session with a passcode. Same as chip & pin…
'security'
Re: Short session expiration does not help security
#406Re: Short session expiration does not help security
#407Earlier quoted context omitted.
> Google runs some very sensitive applications for paying enterprise customers, and they still tend to not expire sessions. For Google Workspace, web applications (e.g. Gmail or Calendar) will regularly force you to re-authenticate "for your security". It's not a daily thing fortunately, but it is common enough to be frustrating.
Session expiration length is a configurable setting by the domain admin, it's not enabled by default.
Re: Short session expiration does not help security
#408Earlier quoted context omitted.
This is just wrong on so many levels. > A short token forces the $1000 withdraw immediately. No, a short token forces the attacker to continue making requests, but otherwise places very few limits on what they can do with it (since these tokens are almost always something like "15 minutes since the last use") > In your ship analogy, that's adding a second hull, putting airtight sections between hull locations, and ha…
>There is a cost every time a user has to re-authenticate. There is a cost in resources to handle the extra authentications. There is a cost in complexity to maintain and extend the system doing authentication. I think this is definitely where the security trends in modern IT have gone very awry, as it _is_ extremely annoying to be an end user having to work with modern IT security practices. Off the top of my head:…
Yup. I'd add to your list: multiple corporate auth systems/domains that are supposed to be in sync, but sometimes aren't. When that breaks, you end up having to turn the Internet off to even log in to your work computer, and find yourself flying out to another country so the IT people there can fix the mess, and this is cheaper than them spending a long time trying to help you remotely, while you can't do any work.
Don't ask me how I know this.
Re: Short session expiration does not help security
#409Earlier quoted context omitted.
>There is a cost every time a user has to re-authenticate. There is a cost in resources to handle the extra authentications. There is a cost in complexity to maintain and extend the system doing authentication. I think this is definitely where the security trends in modern IT have gone very awry, as it _is_ extremely annoying to be an end user having to work with modern IT security practices. Off the top of my head:…
> if you have any issues with your alternative authentication devices, you are completely locked out of your work You have printed the rescue codes when prompted, and have put that physical piece of paper into your wallet, haven't you?
It was sarcastic, right? Right?
Re: Short session expiration does not help security
#410Earlier quoted context omitted.
That's a nightmare process for any normal user. There's no way the vast majority of people are savvy enough to do this correctly.
Which part of the "click print, cut or rip out a corner, put it in your wallet" a nightmare for a normal user? (I'm not one, can't judge.)
- click print - you lost 50%+ of your users there, as approximately nobody has a printer on stand-by at home; if they have it at all, it's a hassle to turn it on, and half the time it's probably broken (ink dried out, etc.)
- put it in your wallet - where? Also, what if you lose your wallet? At least with everything else in it, there's a reasonable process of recovery, usually involving visiting banks and government institutions in person. No such thing for webshit MFA.
This is worth repeating: literally nothing else in your life works like this. There are no other documents that you need to hold on to for a decade or more[0], that are in any way important, and loss of which can't be recovered from. It's an impossible ask for most people, because nobody has habits or even required perspective for such use case.
(What I usually hear from people is, "you should put it your safe". But I don't have one, and I've never (that I know of) met a single person who owned a safe either. It's some American thing, I believe.)
--
[0] - My Google account rescue codes are over a decade old now. I had to use them last year. It's a miracle I still had that piece of paper in my wallet - I've long forgotten about it, but it happened to be put next to a single-page reference for time travelers, so it got transferred to new wallets along with said reference.