Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Frequent reauth doesn't make you more secure

tailscale.com

Post reply on HN
Print view View original

11–20 of 539 posts

Re: Frequent reauth doesn't make you more secure

#11

Post by cosmic_cheese »

lapcat wrote: post #4

OMG I wish that someone would tell this to Apple. Apple's developer services, such as App Store Connect, actually use session cookies. It's infuriating.

Google’s the one I have the most trouble with in this regard. The more things you sign into the worse it gets, seemingly, which really sucks if for example you’ve got a bunch of Android test devices and simulators sharing test accounts. A high profile example is how on the WAN Show, Linus or Luke always get booted out of the show Google Doc and have to sign back in at some point during.

Re: Frequent reauth doesn't make you more secure

#13

Post by paxys »

timewizard wrote: post #9

> What are we really checking? That the security policy for the user and the resulting access key hasn't changed their level of access? Identity, while the most common use case, is only half the system when federating logins.

Why would you need to reauth for that?

Re: Frequent reauth doesn't make you more secure

#15

Post by xyzzy123 »

This depends on your "world model", that is, what situations do you anticipate the people using your web site / application are in?

The assumption that basically, device = same person (browser session really) over a long period of time is the right one, 99% of the time.

Sometimes it's appropriate to make much more conservative assumptions. People might be in bad family situations (where not everyone with access to a shared device might be entirely trustworthy) or using a shared computer because they access things from a library, etc.

You can't help much (the computer might as well be compromised) but short session timeouts can make sense.

Re: Frequent reauth doesn't make you more secure

#17

Post by koakuma-chan »

paxys wrote: post #8
andrewmcwatters wrote: post #5

Earlier quoted context omitted.

Uh, session cookies being one of the most fundamental pieces of authentication tech, there's nothing wrong with them. This is like saying, "example.com actually uses HTTPS. It's infuriating." Do you mean that you have to reauth across domains? Those still use session cookies. Edit: I'm dating myself here, but as far as I can tell apparently sometime between 2010 and 2011, developers started referring to session cooki…

No, sites use persistent cookies , which remain on your browser after you have closed the tab. Session cookies are wiped out automatically after every session.

I set my browser to clear cookies on exit so that my cookies cannot be stolen by malware.

Re: Frequent reauth doesn't make you more secure

#18

Post by voxic11 »

andrewmcwatters wrote: post #5
lapcat wrote: post #4

OMG I wish that someone would tell this to Apple. Apple's developer services, such as App Store Connect, actually use session cookies. It's infuriating.

Uh, session cookies being one of the most fundamental pieces of authentication tech, there's nothing wrong with them. This is like saying, "example.com actually uses HTTPS. It's infuriating." Do you mean that you have to reauth across domains? Those still use session cookies. Edit: I'm dating myself here, but as far as I can tell apparently sometime between 2010 and 2011, developers started referring to session cooki…

> Session cookies are temporary data files stored on a user's device to maintain a user's session on a website or application. They are automatically deleted when the user closes their browser or exits the application, unlike persistent cookies which can store information across sessions.

Most sites do not use session cookies for auth, they use persistent cookies.

Re: Frequent reauth doesn't make you more secure

#20

Post by valenterry »

This is spot on. And it's a general misunderstanding of security in practice. Availability is often missed/ignored (but it is part of security) and attention is an important currency that needs to be treated carefully - or you and up with the mentioned MFA fatigue attacks or people writing down their passwords.
Post reply on HN