Frequent reauth doesn't make you more secure • Hacker News Board

Re: Frequent reauth doesn't make you more secure

#101

Post by mlinhares » Thu, Jun 12, 2025, 9:11 PM UTC

paxys wrote: post #41

princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

And it's even worse if you are accessing Apple services on a non-Apple device. No matter how many times I click "trust device" when logging in to icloud.com it will still make me do the password + one-time code song and dance the next day. Another pointless annoyance - if Face ID fails when making a payment or installing an app (like it frequently does for reasons like sleeping in bed or wearing sunglasses) it won't…

Why in the world does it need you to type a code id you have already accepted it at the other device? This whole flow is stupid, I guess they want to cover their asses.

Re: Frequent reauth doesn't make you more secure

#102

Post by dstroot » Thu, Jun 12, 2025, 9:12 PM UTC

twodave wrote: post #63

The people who need to read these articles are the auditors. Until they change their expectations, the many businesses who have to pass audits are still going to be stuck doing a lot of things that are industry-standard but also very stupid. This is the case even for small businesses in certain fields where security audits are valued. We have at least half a dozen measures in place that we know aren't actually helpfu…

Came here to say this, upvoted. Both Apple and Microsoft have "corporate IT" settings that can be used to turn off "trust my device", "remember me", etc. Auditors and CISO offices tend to lean in on checklist security - in other words it doesn't matter if it's actually more secure, it only matters that it passes the checklist audit. Many of the settings are user hostile and incentivize users to work around them. Making real security worse of course...

Re: Frequent reauth doesn't make you more secure

#103

Post by kiitos » Thu, Jun 12, 2025, 9:14 PM UTC

joshstrange wrote: post #50

kiitos wrote: post #37

Earlier quoted context omitted.

No modern IT organization mandates periodical password changes since, I dunno, mid-2000's. edit : please note the "modern" qualifier, tons of IT orgs continue to mandate this anachronistic policy, sure, but those orgs aren't modern, the policy isn't a requirement for e.g. SOC2 or whatever, it's purely historical inertia.

Nope, not even close. IT depts continue this practice to this day. I had a friend in ~2015 that said they all had barcode scanners plugged into their computers (not 100% what they used them officially for) and so people would print their password as a barcode and stick it under their desk so they just had to scan the barcode to login (most/some/all? USB barcode scanners present as a keyboard and simply send scans as…

Yes, many anachronistic and out-of-date IT depts continue this practice, indeed.

Re: Frequent reauth doesn't make you more secure

#104

Post by sangeeth96 » Thu, Jun 12, 2025, 9:14 PM UTC

princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

Are you sure you have enabled TouchID for purchases (Settings > Touch ID & Password)? If you don't, I guess it might prompt for passwords. I just need to authenticate once on restart but can pretty much use TouchID almost all the time after that anywhere auth is expected.

Re: Frequent reauth doesn't make you more secure

#105

Post by artursapek » Thu, Jun 12, 2025, 9:15 PM UTC

I was working at a crypto exchange for years and completely burned out on reauth. VPN session would die, 20 different SaaS products would log me out, constant interruptions. I’m amazed I never got phished.

Re: Frequent reauth doesn't make you more secure

#106

Post by paxys » Thu, Jun 12, 2025, 9:15 PM UTC

kiitos wrote: post #103

joshstrange wrote: post #50

Earlier quoted context omitted.

Nope, not even close. IT depts continue this practice to this day. I had a friend in ~2015 that said they all had barcode scanners plugged into their computers (not 100% what they used them officially for) and so people would print their password as a barcode and stick it under their desk so they just had to scan the barcode to login (most/some/all? USB barcode scanners present as a keyboard and simply send scans as…

Yes, many anachronistic and out-of-date IT depts continue this practice, indeed.

No true scotsman mandates password changes

Re: Frequent reauth doesn't make you more secure

#107

Post by Henchman21 » Thu, Jun 12, 2025, 9:16 PM UTC

Remember when it was called SINGLE sign on? Emphasis on SINGLE? I mean, this whole idea has been such a mess forever. Why am I prompted to SSO hundreds of times a day?

Re: Frequent reauth doesn't make you more secure

#108

Post by [deleted] » Thu, Jun 12, 2025, 9:16 PM UTC

CamperBob2 wrote: post #74

princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

I'm not surprised that it occasionally prompts for a password (about once or twice a week for me), because otherwise people will forget their passwords and bug them about it. The problem I have is that it doesn't explain who wants the password or why, and the prompts aren't associated with any particular action on my part. Instead, Apple is conditioning people to mindlessly type in their password on demand. Why in th…

[deleted]

Re: Frequent reauth doesn't make you more secure

#109

Post by 6LLvveMx2koXfwn » Thu, Jun 12, 2025, 9:17 PM UTC

paxys wrote: post #88

eddythompson80 wrote: post #84

Earlier quoted context omitted.

Had that on the WiFi system at a facility I used to work from for a while. When you connect to their WiFi, you go to a guest portal to connect to the internet. The guest portal grants your MAC address 24 hours of access. Meaning one day you get to work at 9, the next day you get in at 8:55, you’ll have 5 minutes more of WiFi before things just stop working and your system takes a minute to realize you need to reauth…

And successfully opening a wifi captive portal is the most difficult thing to achieve in all of tech for some reason.

man, I thought that was just me.

Re: Frequent reauth doesn't make you more secure

#110

Post by ryandrake » Thu, Jun 12, 2025, 9:17 PM UTC

CamperBob2 wrote: post #98

hamburglar wrote: post #92

Earlier quoted context omitted.

Yes, it’s really bad for security. I just deny it if I don’t know what it’s for. I’m sure I’m missing out on some very important functionality.

My understanding is that iCloud backup requires it, among who-knows-what other things. So I've been reluctant to hit "Not now." I just have to trust their security model to not allow random apps to pop up and issue those prompts.

I'd be surprised if there aren't malicious apps that pop up their own counterfeit version of Apple's "Just enter your password again, trust me bro" dialog that looks just like the real thing, and then do nefarious things with the trusting user's input.