Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Frequent reauth doesn't make you more secure

tailscale.com

Post reply on HN
Print view View original

191–200 of 539 posts

Re: Frequent reauth doesn't make you more secure

#191

Post by phire »

daneel_w wrote: post #164
socalgal2 wrote: post #51

Earlier quoted context omitted.

Also, every time I plug my iPhone into my Mac for syncing it asks "Trust this Device" both the Mac and the iPhone. I click "yes" and yet it asks again next time.

Help yourself to the system setting "Privacy & Security -> Allow accessories to connect". The sane default is "ask every time", and you probably want "ask for new accessories".

That stops the computer asking, but it doesn't stop the phone asking.

Apple changed this a few years ago, because of a potential security venerability: https://imazing.com/blog/ios-backup-passcode-prompt

Re: Frequent reauth doesn't make you more secure

#192

Post by out-of-ideas »

princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

> it keeps prompting for the Apple password again and again

pro tip (for mac desktop, not iphone): drag the dumb prompt off to the edge of the screen ( i drag from top left of the window and drop it to the bottom right of the monitor )

it will not give a 2nd prompt if the first prompt is closed

=> i do this specifically when the 'apple accounts' crap has some issue and forever prompts me to re-login.

edit: clearification

Re: Frequent reauth doesn't make you more secure

#193

Post by SchemaLoad »

princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

At least for Apple I can see this being a way to avoid account lock out. Your Apple ID password would otherwise almost never be used so when people finally go to factory reset their device or something they would realise they long since forgot their password and now have an expensive brick.

Re: Frequent reauth doesn't make you more secure

#194

Post by notfed »

vizzah wrote: post #178

I just can't stand email OTP. Before we had passwords, now we have passwords + email OTP. And doesn't matter if you forgot password - you will receive password reset to the same email. You already prove email ownership by resetting or using password - why sending another useless "security token" to the same email. Pure nonsense. Whoever designs all of this clearly has little idea of what they are doing :(

I'm confused by this comment. Can you clarify exactly which poor design flow you're talking about?

Re: Frequent reauth doesn't make you more secure

#195

Post by kevincox »

TylerE wrote: post #180
vizzah wrote: post #178

I just can't stand email OTP. Before we had passwords, now we have passwords + email OTP. And doesn't matter if you forgot password - you will receive password reset to the same email. You already prove email ownership by resetting or using password - why sending another useless "security token" to the same email. Pure nonsense. Whoever designs all of this clearly has little idea of what they are doing :(

I’ve kind of become a fan of the sites that don’t even have passwords but just email you a “magic” link. If my account security is tied to my email why make me do extra song and dance if I’m gonna have to fish out an email for every login anyway?

I despise this. With username and password my password manager just fills it in and it is one click to click "login".

With email magic link I need to enter my email (it seems to rarely auto-fill for some reason), then wait (often it takes 10s for the email to be sent for some reason), then if I was logging in on something that isn't my default browser I need to copy+paste the link (often just clicking the link authorizes the source session but not always and you don't know what this site does so you need to do it to be safe). Now you are finally logged in but probably have two tabs open. Either you need to find the first one to continue your session (if it logged that one in) or close it and lose your history for that tab (and hope that the website actually maintained your target page which more often than not it didn't).

Re: Frequent reauth doesn't make you more secure

#197

Post by notfed »

Henchman21 wrote: post #107

Remember when it was called SINGLE sign on? Emphasis on SINGLE? I mean, this whole idea has been such a mess forever. Why am I prompted to SSO hundreds of times a day?

Well, for phones: phones can be lost or stolen. For desktops: an uncomfortable number tend to log in to public computers (eg libraries) without logging out and without understanding the implications.

Re: Frequent reauth doesn't make you more secure

#198

Post by NL807 »

princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

I don't have a problem with reauth if the action(s) in question requires a sudo-like operation with a time-out window. It's just a matter of grouping such actions together in manner that requires the least amount of reauth prompts.

Re: Frequent reauth doesn't make you more secure

#199

Post by kevincox »

antihero wrote: post #24
d4mi3n wrote: post #7

Frequent reauth doesn't meaningfully improve your security posture (unless you have a very, very long expiry), but any auth system worth it's salt should have the capability to revoke a session, either via expiry or by user/device. In practice, I find that the latency between when you want to revoke a session to when that session no longer has access to anything is more important than how often you force reauthentica…

This is why you have refresh tokens - your actual token expires regularly, but the client has a token that allows you to get a new one. Revoking is a case of not allowing them to get a new one.

This is really just an optimization. It means that you don't need to do an expiry check on the regular token, only on the refresh token. It doesn't change the fact that you should be able to revoke a session before it naturally expires.

Re: Frequent reauth doesn't make you more secure

#200

Post by marcosdumay »

cesarb wrote: post #174
c17r wrote: post #138

Earlier quoted context omitted.

As far as I've understood/remember SSO was logging on with a single ID and not logging on a single time.

> As far as I've understood/remember SSO was logging on with a single ID and not logging on a single time. What I remember is that the promise of SSO in the 1990s and early 2000s was that you would login only ONCE, onto your desktop. The operating system would use that login to acquire NTLM or Kerberos tokens, which would then be used to authenticate everything else: shared drives, printers, even web sites would be a…

> Of course, that only really works that well in an homogeneous environment

It works if no monopoly abuses their position by sabotaging the standard.

OAuth is getting a chance to work because neither Google, Apple nor Facebook are big enough, and they don't play well with each other. At least right now.

Post reply on HN