Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Short session expiration does not help security

sjoerdlangkemper.nl

Post reply on HN
Print view View original

411–420 of 434 posts

Re: Short session expiration does not help security

#411

Post by TeMPOraL »

nine_k wrote: post #315
bmurphy1976 wrote: post #257

Earlier quoted context omitted.

The part where you actually have to do it. And the part where you remember where you put it. What happens when you lose your wallet? Or when the paper gets crumped up and ruined? Or wet? Do they put it in a lock box? What good does that do them when they are in another country? What if they reset their password and have to reset their codes but forget to update the paper? Or what about when you have the old and new c…

Actually have to do it: I see, but really, dear real user, you are adept at printing pages, you do it quickly and masterfully, just click the button now. Remember where you put it: the answer is trivial and always the same, "your wallet". The tech support will remind you to look in your wallet if you come to them with your problem.

Most people don't have printers on standby. Most wallets have lifetimes way shorter than those of account rescue codes. Everything else in a wallet - government-issued IDs, bank cards, etc. - has lifetimes way shorter than those of account rescue codes.

Re: Short session expiration does not help security

#412

Post by dang »

horsawlarway wrote: post #18
klodolph wrote: post #8

> Also, it would be better to protect against this by securing the logs or using hard drive encryption. This one line is emblematic of the flaws in the article. My take on the article is, “Imagine that everything else in a system is done correctly, and the system, overall, is perfectly secure. In this imaginary world, short sessions don’t help.” One fact about security which you cannot avoid is that any one particula…

> Short sessions are there because there are various ways that sessions could be compromised. You haven't actually addressed either of the author's points, though. Namely: 1: A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal. 2: The vast majority of ways to compromise a session already give you access far beyond that session itself…

Can you please not post in the flamewar style to HN? I realize it's the tradition in some online circles, but it's not what this site is for, and destroys what it is for.

If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.

Re: Short session expiration does not help security

#413

Post by dang »

jameshart wrote: post #83
horsawlarway wrote: post #18

Earlier quoted context omitted.

> Short sessions are there because there are various ways that sessions could be compromised. You haven't actually addressed either of the author's points, though. Namely: 1: A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal. 2: The vast majority of ways to compromise a session already give you access far beyond that session itself…

> This attitude is cancer > yes really - fucking always You're really angry with that straw man you've stood up. The OP isn't saying systems have to be locked down to the extent that they're useless. Who would ever argue for such a thing? Note that "You don't stop securing it just because you've found one good option" is NOT the same thing as saying "You don't stop securing it until you've closed every possible secur…

Please don't cross into personal attack, no matter how bad another comment was or you feel it was. It only makes things worse.

(I appreciate that you're arguing for charitable interpretation, but the personal swipes at the beginning and end of your post wipe out the good effect and then some.)

https://news.ycombinator.com/newsguidelines.html

Re: Short session expiration does not help security

#414

Post by msm_ »

matheusmoreira wrote: post #373
hahn-kev wrote: post #372

Earlier quoted context omitted.

Except our only solution to this problem today IS government provided already (ID SSN or Passport).

Which is dehumanizing. We are not cattle to be identified and marked.

But you need a way to identify people. If there's no good way to identify real people (government issued ID number), those that need them will invent bad ones (SSN, phone number, maiden name, maybe more). And companies like Google have their own identifier for you already, anyway. And you can't travel anywhere without a passport that is another identifier, anyway.

I'm impressed how much Americans dislike the idea of a mandatory government issued ID. I don't mean it in a bad way - this sounds like a very principled and idealistic stance. I just really like my government issued ID, and consider it a reasonable tradeoff.

Re: Short session expiration does not help security

#415

Post by lozenge »

ljm wrote: post #286
actuallyalys wrote: post #186

The main place I see short session expirations is on banking and financial apps, which seems defensible to me for a couple of reasons: 1) They're used by a wide variety of people, including people who may not own a computer or mobile device, or who may not have a backup device to use when their personal device breaks. This group is probably shrinking—more and more people have smartphones and the remaining people who…

My main bank uses username + password + (random subset of ‘memorable word but actually unencrypted password’ driven by select boxes), then 2FA on top, and it literally feels like they just slapped a bunch of things together to add extra barriers to auth in sequence. This is the UK. Back in Latvia I would just slide my ID card into a USB reader and cryptographically sign the session with a passcode. Same as chip & pin…

I was about to tell you to switch banks, then I realised you just described my bank.

Yeah, I don't understand why none of the mobile-friendly banks are willing to build even a basic web interface for use on the big screen.

Re: Short session expiration does not help security

#417

Post by greedo »

ndriscoll wrote: post #398
greedo wrote: post #108

Earlier quoted context omitted.

Exactly. Anyone working in a moderately large company (500+ employees) or in a regulated industry is familiar with this issue. Just as no politician wants to be seen as soft on crime, no CISO want's to be blamed for a security breach. So more and more security gets piled on to every process and application. MFA everywhere, even though you're required to use MFA for the VPN. SSO everywhere, because why not. Session ex…

What do you have against SSO everywhere? I see it as actually one of the things that makes obvious sense. It makes the user's life easier and improves security. It makes it easy to give a new employee access to a bunch of systems at once using RBAC. That and putting users' SSH public keys in LDAP and using that for auth everywhere instead of passwords are two obvious pure wins to me.

SSO is great in a monoculture environment, but falls down in heterogenous systems. We have Azure SSO, Ping Federate, and a couple of others we're getting rid of. I think it adds unnecessary complexity, and fails too often. Our internal users don't like it because the failure modes are opaque to them compared to a userid/password.

Re: Short session expiration does not help security

#418

Post by horsawlarway »

nine_k wrote: post #315
bmurphy1976 wrote: post #257

Earlier quoted context omitted.

The part where you actually have to do it. And the part where you remember where you put it. What happens when you lose your wallet? Or when the paper gets crumped up and ruined? Or wet? Do they put it in a lock box? What good does that do them when they are in another country? What if they reset their password and have to reset their codes but forget to update the paper? Or what about when you have the old and new c…

Actually have to do it: I see, but really, dear real user, you are adept at printing pages, you do it quickly and masterfully, just click the button now. Remember where you put it: the answer is trivial and always the same, "your wallet". The tech support will remind you to look in your wallet if you come to them with your problem.

Yup - let me just go get my "wallet binder" from the storage yard I have to keep it in after adding 800 pages of backup codes (which is literally not an exaggeration - I have more than 800 active accounts between personal/work/contracting).

Let me just bind this fucking book over here, after I ran out of printer ink twice while printing it, and shove that right on into my little wallet flap.

Perfect! Why didn't I think of this sooner!

Re: Short session expiration does not help security

#419

Post by horsawlarway »

paulddraper wrote: post #259
horsawlarway wrote: post #240

Earlier quoted context omitted.

> For the local system, yes. But not the for the remote system. This is fair, although you've picked a specific case where the local system would not likely access the remote system again after compromise (because theft removes access for the normal user) and an expired session might be helpful as security. But the other thing about theft is that it also immediately alerts the user, and having a simple "Sign me out e…

> theft is that it also immediately alerts the user The user may or may not know of theft or leak. And even if they are aware, they may not know remember every remote system they were logged into. > Rotate it after 30 days if you want (or 5 days, or 1 day - just don't do it every 15 minutes). So we've gone from arguing that short sessions doesn't work, to arguing that it works for such a large % of the cases that it…

I don't think my argument has changed a whit - Short sessions cause more pain than they solve. They are a bad security tool for almost all products.

Arguing that short sessions are bad is not the same as arguing that rotation never has its place. Rotation can provide some benefits.

My argument is that EXCESSIVE rotation (aka: short sessions, the whole freaking conversation) is folly.

It's a bad decision usually implemented without thought or understanding (it's on the checklist...), which has a high cost to users, and actively degrades the product.

In return for the costs of short sessions, what are you proposing that your users gain?

Because personally, logging in every 15 minutes for the rest of my life is a god damn travesty of an exchange to make to cover me on the one case where my laptop goes missing. Especially since that's not a very common vector for account theft. It's SO much more likely someone just calls the help center and claims to be me and gets in just fine.

Re: Short session expiration does not help security

#420

Post by zigzag312 »

caskstrength wrote: post #389
megous wrote: post #388

Earlier quoted context omitted.

Smartphone sounds like the worst device you can use for banking. If remotely compromised, the attecker gets everything they need. The SMS second factor, the user's password, access to user's network, and the user's behavior profile to know when to execute the attack so that they get as much time for it as possible.

On the other hand I would assume that modern smartphones from manufacturers that care about security to some degree are much harder to compromise compared to random Windows laptops.

Pixel phones had exploit discovered last year where you could unlock any phone by entering the PUK code. You just replaced the SIM card with your own SIM for which you knew the PUK. Seems very easy to me.

https://9to5google.com/2022/11/10/pixel-lockscreen-unlock-bu...

Post reply on HN