Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Frequent reauth doesn't make you more secure

tailscale.com

Post reply on HN
Print view View original

111–120 of 539 posts

Re: Frequent reauth doesn't make you more secure

#111

Post by babypuncher »

d4mi3n wrote: post #7

Frequent reauth doesn't meaningfully improve your security posture (unless you have a very, very long expiry), but any auth system worth it's salt should have the capability to revoke a session, either via expiry or by user/device. In practice, I find that the latency between when you want to revoke a session to when that session no longer has access to anything is more important than how often you force reauthentica…

It's a balancing act. The more annoying your auth requirements are, the more likely users are to look for insecure shortcuts that make using their computer less miserable.

Re: Frequent reauth doesn't make you more secure

#112

Post by thyristan »

kiitos wrote: post #37
paxys wrote: post #16

Corporate IT still makes you change your password every N months. Tell them to extend the max session length beyond a day and some VP will have an aneurysm.

No modern IT organization mandates periodical password changes since, I dunno, mid-2000's. edit : please note the "modern" qualifier, tons of IT orgs continue to mandate this anachronistic policy, sure, but those orgs aren't modern, the policy isn't a requirement for e.g. SOC2 or whatever, it's purely historical inertia.

Even worse. NIS2 in the European Union makes password changes legally required for many organisations.

https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=PI_... 11.6.2 (c)

Re: Frequent reauth doesn't make you more secure

#113

Post by crazygringo »

Xevion wrote: post #99
sircastor wrote: post #65

Earlier quoted context omitted.

I have a very old iPad that my kid uses. It’s stuck to iOS 10.3. Also, it can’t use my password manager. The browser is so old that the website won’t load (32-bit app). And the PW manager app isn’t made for this old a device. So Apple wants me to type in my 50+ character password every time I use the App Store app. It’s such a pain.

Then why'd you pick a 50+ character password? No one made you do that. That's your fault, not Apple's. - As you said, it's a multi-platform account, so probably multiple devices in multiple locations will need the password. Meaning you won't have easy access to your password manager. - Popular account, so you'll likely be using it often, probably re-typing or pasting it. Common sense says that manually typing out a p…

> Switch to a phrase-based password.

I assume that's why it's 50+ characters long, as opposed to 20 gibberish characters. Because phrase-based passwords are longer. And whether it's 40 or 50 or 50+ doesn't even matter, the point is it's not short like a 6-digit PIN.

I have the exact same problem. It's still incredibly annoying to type on a touchscreen keyboard. If you mistype one character...

So no, it's not the commenter's fault. And it's certainly not mine. I'm doing the best with the tools I have available. It's Apple's fault, mainly.

Re: Frequent reauth doesn't make you more secure

#115

Post by crazygringo »

sangeeth96 wrote: post #104
princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

Are you sure you have enabled TouchID for purchases (Settings > Touch ID & Password)? If you don't, I guess it might prompt for passwords. I just need to authenticate once on restart but can pretty much use TouchID almost all the time after that anywhere auth is expected.

I have on mine, and yes it always prompts for a password anyways if I haven't used the App Store extremely recently (like within the past 24 hours).

I'd assume it's a straight-up bug on Apple's part, but they haven't fixed it for years and years, so at this point I think they're just being sadistic.

Because yes TouchID works everywhere else. This is App Store-specific. It's literally the only reason I keep a password manager app on my home screen, since it autofills everywhere else but not there so I have to always copy my Apple password manually from the password manager app.

Re: Frequent reauth doesn't make you more secure

#116

Post by mbreese »

paxys wrote: post #79
sircastor wrote: post #65

Earlier quoted context omitted.

I have a very old iPad that my kid uses. It’s stuck to iOS 10.3. Also, it can’t use my password manager. The browser is so old that the website won’t load (32-bit app). And the PW manager app isn’t made for this old a device. So Apple wants me to type in my 50+ character password every time I use the App Store app. It’s such a pain.

If it helps there's no security advantage of a 50+ character password over a suitable 16 character one.

Yeah, but passphrases don’t require switching keyboards as often in mobile. And if you’re using a 16 character P@s5w0R6, a 50 character passphrase can be just as secure.

What I can’t stand if when I’m prompted to type a password on my Apple TV and can’t use my phone for some reason. Scrolling across the alphabet for a passphrase is torture.

Re: Frequent reauth doesn't make you more secure

#117

Post by reddalo »

mlinhares wrote: post #101
paxys wrote: post #41

Earlier quoted context omitted.

And it's even worse if you are accessing Apple services on a non-Apple device. No matter how many times I click "trust device" when logging in to icloud.com it will still make me do the password + one-time code song and dance the next day. Another pointless annoyance - if Face ID fails when making a payment or installing an app (like it frequently does for reasons like sleeping in bed or wearing sunglasses) it won't…

Why in the world does it need you to type a code id you have already accepted it at the other device? This whole flow is stupid, I guess they want to cover their asses.

I agree with you, but it's the same reason why Microsoft asks you to type a numeric code generated by their Outlook app in order to login. It's to prevent people from dismissing the alert by clicking "OK" without even reading (especially if they're in the middle of something else, e.g. during a scam phone call).

Re: Frequent reauth doesn't make you more secure

#118

Post by sangeeth96 »

I disagree with the general advise behind this, even when I'm in a household with trusted (most of the time) family members. Forcing a re-auth ensures that even if I forget to lock my machine/browser, someone can't snoop around. I want this to be the norm especially for my Macbook since for whatever reason, I might forget to lock or have some program running that'll force the laptop to not auto lock out (e.g. while downloading something that takes a long time) so I don't want someone to be able to seize that opportunity.

It's the same reason I intentionally lock up apps with TouchID when there's remotely anything sensitive in there. I just don't want someone to be able to snoop if I forget to lock my phone.

I'll say however, there should be easier ways to reauth in such scenarios. Like in my case, TouchID is not very disruptive to my work even if a prompt appears. I'll also say it's probably stupid to lock out when there's continuous activity (should lock based on inactivity period).

The worst offenders in my experience are banking apps. They:

  - Force logout sometimes regardless of ongoing activity
  - Log out as soon as I close the tab
  - Log out when I press the back/reload button
  - After logging out, impose a mandatory inactivity period before I can login again (this is just the most idiotic thing EVER)
  - Use JS to block any kind of copy/paste operation on username/password fields
  - Never integrate with modern auth mechanisms, not even app-based TOTP!
  - Have crazy password expiry windows (like every quarter) and force password change when your previous password expires, regardless of how strong they are

Re: Frequent reauth doesn't make you more secure

#119

Post by creamstout83 »

timewizard wrote: post #9

> What are we really checking? That the security policy for the user and the resulting access key hasn't changed their level of access? Identity, while the most common use case, is only half the system when federating logins.

Validated the user that logged in is still the same person.

Re: Frequent reauth doesn't make you more secure

#120

Post by olddustytrail »

falcor84 wrote: post #64
grishka wrote: post #57

Earlier quoted context omitted.

Remembering things reliably must be the most unsolvable problem in computer science. Unless it's related to advertising. Then it works flawlessly and sometimes survives device transfers and factory resets.

"The best minds of my generation are thinking about how to make people click ads." -Jeff Hammerbacher

I saw the best minds of my generation destroyed by madness, starving hysterical naked, dragging themselves through the negro streets at dawn looking for an angry fix
Post reply on HN