Live data from Hacker News

Short session expiration does not help security

sjoerdlangkemper.nl

401–410 of 434 posts

Re: Short session expiration does not help security

#401

Earlier quoted context omitted.

Spains banks (I’ve used two so far) simply use your ID number which is used in a lot of places and not considered secret and enforces a 4 digit password. It’s an absolute joke.

Bank Of America requires to tell them a 2FA code sent over SMS, when SMS literally says: BofA: DO NOT share this code. We will NEVER call you or text you for it. No, it wasn't scam, seen that process physically visiting a branch on agent's display multiple times.

My bank does that for in person visits but you key in the code on a PoS style keypad at their desk

Re: Short session expiration does not help security

#402

Earlier quoted context omitted.

Which is dehumanizing. We are not cattle to be identified and marked.

Ah so you are the man with no name, I assume?

My parents giving me a name is one thing. The state giving me a number and arresting me if I fail to produce that number to police on demand is another.

Re: Short session expiration does not help security

#403
post #339

Earlier quoted context omitted.

I see pretty short timers in enterprise saas as well. Reason being that having a license for 400 users is much more expensive than a license for 30 users.

Pretty much all SaaS products charge per unique user, not active sessions, so I don’t really understand what point you’re trying to convey.

Nearly all of our agreements are in active sessions. I guess your business just needs better negotiation?

Re: Short session expiration does not help security

#404
post #378
post #126

Earlier quoted context omitted.

I couldn’t agree more. Security is almost always user hostile (speaking from a UX perspective). I am NOT advocating that we remove security for obvious reasons (a hacked app is also user hostile). HOWEVER - if we can just acknowledge that security is antithetical to an easy to use, user friendly app then we can make appropriate decisions moving forward. One of my favorite sayings is “if you are not careful, you are g…

Is there a term for this kind of thinking, or a type of job role in security that focuses on problems like this? Are there any professional 'strategic rearranger of security complexity' or 'security UX champion' jobs out there? This seems like it could be a really valuable and maybe also fun role, if one can find an org that has made room for it.

This isn’t a security mindset, it is a product development mindset. You run into problems creating these situations like we are discussing when roles across the company diverge and no one is responsible for the big picture. The security guy doesn’t care about product management, and the product guy usually doesn’t see the value in security. Good founders get this.

Re: Short session expiration does not help security

#405
post #286

The main place I see short session expirations is on banking and financial apps, which seems defensible to me for a couple of reasons: 1) They're used by a wide variety of people, including people who may not own a computer or mobile device, or who may not have a backup device to use when their personal device breaks. This group is probably shrinking—more and more people have smartphones and the remaining people who…

My main bank uses username + password + (random subset of ‘memorable word but actually unencrypted password’ driven by select boxes), then 2FA on top, and it literally feels like they just slapped a bunch of things together to add extra barriers to auth in sequence. This is the UK. Back in Latvia I would just slide my ID card into a USB reader and cryptographically sign the session with a passcode. Same as chip & pin…

My 'UK' bank recently dropped using the password completely, likely because someone pointed out to them that since you could simply reset the password via the SMS 2FA, it was essentially pointless. So now the SMS and a 5 digit PIN are all it takes. Eventually they'll figure out that the PIN can be reset via 'just an SMS' too.

'security'

Re: Short session expiration does not help security

#406

Earlier quoted context omitted.

Ah so you are the man with no name, I assume?

My parents giving me a name is one thing. The state giving me a number and arresting me if I fail to produce that number to police on demand is another.

It’s funny you think there’s a difference

Re: Short session expiration does not help security

#407
post #96

Earlier quoted context omitted.

> Google runs some very sensitive applications for paying enterprise customers, and they still tend to not expire sessions. For Google Workspace, web applications (e.g. Gmail or Calendar) will regularly force you to re-authenticate "for your security". It's not a daily thing fortunately, but it is common enough to be frustrating.

Session expiration length is a configurable setting by the domain admin, it's not enabled by default.

Oh is that why it asks for re-auth all the time? I thought it was built in. Nice, I’m going to disable that.

Re: Short session expiration does not help security

#408
post #149

Earlier quoted context omitted.

This is just wrong on so many levels. > A short token forces the $1000 withdraw immediately. No, a short token forces the attacker to continue making requests, but otherwise places very few limits on what they can do with it (since these tokens are almost always something like "15 minutes since the last use") > In your ship analogy, that's adding a second hull, putting airtight sections between hull locations, and ha…

>There is a cost every time a user has to re-authenticate. There is a cost in resources to handle the extra authentications. There is a cost in complexity to maintain and extend the system doing authentication. I think this is definitely where the security trends in modern IT have gone very awry, as it _is_ extremely annoying to be an end user having to work with modern IT security practices. Off the top of my head:…

> It really sucks to be an end user in such environments, and it's just too easy for IT security to absolutely lock out legitimate users who are following the policies as best they can with earnest intent.

Yup. I'd add to your list: multiple corporate auth systems/domains that are supposed to be in sync, but sometimes aren't. When that breaks, you end up having to turn the Internet off to even log in to your work computer, and find yourself flying out to another country so the IT people there can fix the mess, and this is cheaper than them spending a long time trying to help you remotely, while you can't do any work.

Don't ask me how I know this.

Re: Short session expiration does not help security

#409
post #163
post #149

Earlier quoted context omitted.

>There is a cost every time a user has to re-authenticate. There is a cost in resources to handle the extra authentications. There is a cost in complexity to maintain and extend the system doing authentication. I think this is definitely where the security trends in modern IT have gone very awry, as it _is_ extremely annoying to be an end user having to work with modern IT security practices. Off the top of my head:…

> if you have any issues with your alternative authentication devices, you are completely locked out of your work You have printed the rescue codes when prompted, and have put that physical piece of paper into your wallet, haven't you?

Upvoted for the sharp sarcasm that's dripping from this comment.

It was sarcastic, right? Right?

Re: Short session expiration does not help security

#410
post #226

Earlier quoted context omitted.

That's a nightmare process for any normal user. There's no way the vast majority of people are savvy enough to do this correctly.

Which part of the "click print, cut or rip out a corner, put it in your wallet" a nightmare for a normal user? (I'm not one, can't judge.)

> Which part of the "click print, cut or rip out a corner, put it in your wallet" a nightmare for a normal user? (I'm not one, can't judge.)

- click print - you lost 50%+ of your users there, as approximately nobody has a printer on stand-by at home; if they have it at all, it's a hassle to turn it on, and half the time it's probably broken (ink dried out, etc.)

- put it in your wallet - where? Also, what if you lose your wallet? At least with everything else in it, there's a reasonable process of recovery, usually involving visiting banks and government institutions in person. No such thing for webshit MFA.

This is worth repeating: literally nothing else in your life works like this. There are no other documents that you need to hold on to for a decade or more[0], that are in any way important, and loss of which can't be recovered from. It's an impossible ask for most people, because nobody has habits or even required perspective for such use case.

(What I usually hear from people is, "you should put it your safe". But I don't have one, and I've never (that I know of) met a single person who owned a safe either. It's some American thing, I believe.)

--

[0] - My Google account rescue codes are over a decade old now. I had to use them last year. It's a miracle I still had that piece of paper in my wallet - I've long forgotten about it, but it happened to be put next to a single-page reference for time travelers, so it got transferred to new wallets along with said reference.

Post reply on HN