Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Frequent reauth doesn't make you more secure

tailscale.com

Post reply on HN
Print view View original

221–230 of 539 posts

Re: Frequent reauth doesn't make you more secure

#221

Post by catlifeonmars »

spacebanana7 wrote: post #182
immibis wrote: post #165

Earlier quoted context omitted.

In a free market, you don't - you start your own company that doesn't waste half of everyone's time on security, and do stuff twice as efficiently, for half the price and outcompete the other one. Then you get outcompeted by a company with no security at all, which is twice as efficient as you until they get hacked.

Good security, the stuff that actually stops you from getting hacked, shouldn’t be considered wasteful. And eliminating good security shouldn’t be considered an improvement in efficiency. Ideally we should use the word “waste” to narrowly point at activities that are entirely pointless. Like requiring password rotation every 7 days.

There is no incentive to do so when the shareholders are only interested in the next quarterly earnings report.

Re: Frequent reauth doesn't make you more secure

#222

Post by Retric »

xp84 wrote: post #214
throwaway843 wrote: post #203

Earlier quoted context omitted.

1234abcd@ it is then for all my accounts.

Password rotation does nothing more than get you to use 1234abcd@ 1234abcd@1 1234abcd@2 1234abcd@3 I'm becoming pretty convinced that at least in the corporate space, we'd be way better off with a required 30 character minimum password, with the only rules being against gross repetition or sequences. (no a * 30 or abcd...yz1234567890 ). Teach people to use passphrases and work on absolutely minimizing the number of t…

I’m doubtful a 30 digit minimum password is a meaningful improvement over a 20 digit password here. Meanwhile actually typing in very long passwords adds up across a workday/year especially with mistakes.

Re: Frequent reauth doesn't make you more secure

#223

Post by xp84 »

count wrote: post #154
thyristan wrote: post #83

Earlier quoted context omitted.

Microsoft crap is similarly broken. After each and every login there is the question whether it should remember me and whether it should ask that question again. It doesn't matter at all what you answewr there, it changes absolutely nothing.

Disable anti-tracking features and ad blocks, it turns out cookies and temp storage for ad tracking are how IDPs track your choice to trust the device too.

Most adblockers etc are pretty selective about cookies.

I guess if you got really aggressive like an allow-list approach, you could have friction, but just using ublock's defaults I don't get 'unrecognized' from anything any quicker than I do on a device without it.

Re: Frequent reauth doesn't make you more secure

#224

Post by pfych »

gausswho wrote: post #170
pfych wrote: post #146

Earlier quoted context omitted.

It at least got me to learn how to self-host my own identity provider!

Do tell!

I set up Authentik[^1] on my NAS in a docker container and went from there! Just had to add a .well-known webfinger file to my domain that pointed to the Authentik instance and it "just worked" with Tailscale.

[^1]: https://goauthentik.io/

Re: Frequent reauth doesn't make you more secure

#225

Post by xp84 »

everforward wrote: post #210
princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

I think free apps are still scrutinized because they don’t want attackers to install known-compromised apps or trackers. Like a controlling spouse sneakily face IDing a sketchier Life360 while “making a phone call”. Could be wrong, but that’s the only thing I can think of.

For sure. They don't really need to protect your credit card in that way, since if a silly kid bought $300 worth of Super Gems or installed a paid app (are there even any normal paid apps now?) Apple has full control, if you call support, to just say "nope" and take the money back and refund you. But sneaking any random app onto the phone of someone else for nefarious reasons is something Apple is super paranoid about.

Which is also why I will get random popups every few weeks for the rest of my life saying things like "Google Maps has been using your location for 179 days." with a "scary" little map of where I've been. No amount of saying "yes, i meant to do that" can convince Apple that it's intentional.

Re: Frequent reauth doesn't make you more secure

#226

Post by catlifeonmars »

kevincox wrote: post #199
antihero wrote: post #24

Earlier quoted context omitted.

This is why you have refresh tokens - your actual token expires regularly, but the client has a token that allows you to get a new one. Revoking is a case of not allowing them to get a new one.

This is really just an optimization. It means that you don't need to do an expiry check on the regular token, only on the refresh token. It doesn't change the fact that you should be able to revoke a session before it naturally expires.

Having a short session expiry is a workaround for not being able to revoke a token in real time. This is really the fault of stateless auth protocols (like OAuth) which do offline authentication by design. This allows authentication to scale in federated identity contexts.

Re: Frequent reauth doesn't make you more secure

#227

Post by catlifeonmars »

dheera wrote: post #26
d4mi3n wrote: post #7

Frequent reauth doesn't meaningfully improve your security posture (unless you have a very, very long expiry), but any auth system worth it's salt should have the capability to revoke a session, either via expiry or by user/device. In practice, I find that the latency between when you want to revoke a session to when that session no longer has access to anything is more important than how often you force reauthentica…

Frequent reauth only makes people figure out hacks to work around it. Passwords get written down, passwords end up in Google Docs, Arduinos with servos get attached to Yubikeys, SMS gets forwarded to e-mail, TOTP codes get sent over Wechat, the whole works

> SMS gets forwarded to email

This hop is actually more secure than receiving an SMS natively. Your mobile network provider can already read all of your SMS and there are tons of exploits for modifying the receiver of SMS in the wild. SMS is a terrible way to send information securely.

Re: Frequent reauth doesn't make you more secure

#228

Post by xp84 »

makeitdouble wrote: post #142
carlosjobim wrote: post #128

Earlier quoted context omitted.

People are supposed to have extremely complicated passwords, which are impossible to remember. The security is in your biometric ID. There is no reason for a person to ever have to remember any password except their login password, as long as they are using a device with biometric ID. And as far as I know, almost all Apple devices currently for sale have biometric ID. iCloud is the only login that regularly breaks bi…

People are _required_ to have complicated passwords in most services. Yet they'll still make you type it out in so many situations, including on account creation confirmation where some service will even block copy/paste to push you to type it. Services will accept losing an user over password grating issues ("no compromise on security"), so it just gets worse and worse.

I get absolutely enraged at sites that block pasting. The two I know of are Quickbooks when paying an invoice with ACH and my tax collector website.

I'm pasting in a bank account number and some dumb person somewhere though, "Our users might be pasting in a bank account number... from... a 'bad' copy of it. Let's force them to potentially have to app switch repeatedly, and type 3 numbers at a time, from a 12-digit number they don't know well. Because we don't trust this 'Paste' voodoo!"

Even if I'm on a PC with windowing and don't have to app switch, the amount of misguided paternalism needed to tell me I cannot paste fills me with rage.

Re: Frequent reauth doesn't make you more secure

#229

Post by TZubiri »

xp84 wrote: post #214
throwaway843 wrote: post #203

Earlier quoted context omitted.

1234abcd@ it is then for all my accounts.

Password rotation does nothing more than get you to use 1234abcd@ 1234abcd@1 1234abcd@2 1234abcd@3 I'm becoming pretty convinced that at least in the corporate space, we'd be way better off with a required 30 character minimum password, with the only rules being against gross repetition or sequences. (no a * 30 or abcd...yz1234567890 ). Teach people to use passphrases and work on absolutely minimizing the number of t…

"Your password is too similar to your previous password"

Hmm, how would you know that.

Re: Frequent reauth doesn't make you more secure

#230

Post by croemer »

mountainriver wrote: post #157
princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

I have to change my apple password every single time I need to download an app. It seems like insane friction for something that is making them a lot of money

Same. And annoyingly you're not allowed to reuse old passwords, so you have to keep inventing (and remembering) new ones.
Post reply on HN