Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Short session expiration does not help security

sjoerdlangkemper.nl

Post reply on HN
Print view View original

341–350 of 434 posts

Re: Short session expiration does not help security

#341

Post by joseda-hg »

gregopet wrote: post #302
paulddraper wrote: post #144

> Perhaps you used the shared computer in the library to access your web application, and forgot to log out. > Is this a thing? Are shared computers without user separation a thing? If so, these shouldn’t be used to access web applications with sensitive information at all. Yes, it is a thing. I understand you would like it to not be a thing.

Even if it is a thing - after using a shared computer one MUST log out. If the 15 minute expiration time saved you then you're just damned lucky!

That's reasonable to do, but not necesarily to ask for What if you loose your internet connection and can't log out? Or have a power cut, or have to leave in a hurry, or drop dead on the keyboard while using the computer

Unfortunately for devs, RL is messy and even if you can convince some people to do the best thing, if you're large enough you have to go by Murphy's Law and work around the people that you know won't / can't

Re: Short session expiration does not help security

#342

Post by linuxdude314 »

wredue wrote: post #339
actuallyalys wrote: post #186

The main place I see short session expirations is on banking and financial apps, which seems defensible to me for a couple of reasons: 1) They're used by a wide variety of people, including people who may not own a computer or mobile device, or who may not have a backup device to use when their personal device breaks. This group is probably shrinking—more and more people have smartphones and the remaining people who…

I see pretty short timers in enterprise saas as well. Reason being that having a license for 400 users is much more expensive than a license for 30 users.

Pretty much all SaaS products charge per unique user, not active sessions, so I don’t really understand what point you’re trying to convey.

Re: Short session expiration does not help security

#343

Post by 1vuio0pswjnm7 »

"Session tokens are pretty secure. The threats described above are easily fixed with other measures, such as disk encryption, locking your computer, or HttpOnly cookies."

Or simply log out if a token is stolen.^1 After logging out, the session token is expired. In some cases one can log out non-interactively with a single HTTP request. No need to visit a page in a Javascript-enabled graphical browser and navigate interfaces.

One can use a forward proxy to insert tokens for selected sites. This allows one to scrub/disable/clear cookies globally but stil remain "logged in" for certain sites.

1. The problem is the user might be unaware that a token has been stolen, at least until it is too late.

Re: Short session expiration does not help security

#344

Post by fsckboy »

actuallyalys wrote: post #186

The main place I see short session expirations is on banking and financial apps, which seems defensible to me for a couple of reasons: 1) They're used by a wide variety of people, including people who may not own a computer or mobile device, or who may not have a backup device to use when their personal device breaks. This group is probably shrinking—more and more people have smartphones and the remaining people who…

> I suspect that's the actual best solution if avoiding session stealing is that big of a concern

that big of a concern for whom? Google doesn't care because Google has constructed a world where when something goes wrong, sorry, it's on you.

Your bank does care because if something goes wrong, it's frequently on them. The bank times you out to protect them more than you.

Re: Short session expiration does not help security

#345

Post by Zetice »

grishka wrote: post #340
Zetice wrote: post #311

Earlier quoted context omitted.

A hacker would start salivating if they heard someone who built a product storing PII said what you just did about session tokens for your personal projects.

And? I assume that my users are smart. By the way, social media services like Facebook do store PII and have non-expiring sessions. And somehow, if someone's account is hacked, it's that person's problem, not Facebook's.

...it's 100% Facebook's problem.

I sometimes forget there is no barrier to entry on this website, thank you for reminding me.

Re: Short session expiration does not help security

#346

Post by AnthonyMouse »

williamcotton wrote: post #303
ljm wrote: post #286

Earlier quoted context omitted.

My main bank uses username + password + (random subset of ‘memorable word but actually unencrypted password’ driven by select boxes), then 2FA on top, and it literally feels like they just slapped a bunch of things together to add extra barriers to auth in sequence. This is the UK. Back in Latvia I would just slide my ID card into a USB reader and cryptographically sign the session with a passcode. Same as chip & pin…

I’m so envious of the Baltic’s use of technology at the institutional level. It seems literally infeasible for the United States to have state-issued PKI. It’s a meta-partisan issue: no side trusts the other to manage crypto or computer systems. So for example instead of a public many-to-many digital publishing platform we are stuck with the whims of grown men who want to fist fight each other in the Colosseum and al…

If the government wants to do something they should publish open source code that implements a sane authentication system, and then have no part of operating it whatsoever. If it's good and free people will use it voluntarily. If it isn't then you certainly don't want the same people implementing anything mandatory.

Re: Short session expiration does not help security

#347

Post by xp84 »

labster wrote: post #331
williamcotton wrote: post #303

Earlier quoted context omitted.

I’m so envious of the Baltic’s use of technology at the institutional level. It seems literally infeasible for the United States to have state-issued PKI. It’s a meta-partisan issue: no side trusts the other to manage crypto or computer systems. So for example instead of a public many-to-many digital publishing platform we are stuck with the whims of grown men who want to fist fight each other in the Colosseum and al…

The USA was distrustful of national ID cards decades before the current level of hyperpartisan rancor. We just don’t the government enough to let them track us everywhere. Not that the current climate helps. The REAL ID Act of 2005 has been delayed so many times, now to 2025. Maybe we should just repeal it instead.

> We just don’t the government enough to let them track us everywhere.

That statement is both true and emblematic of the problem. Everyone is so cynical that a clean public-key, offline, certificate-based solution, with an absolute zero visibility to the government of who is doing what, would always be assumed to be part of some nefarious Illuminati/Democrat/Republican plot. Proving it to people with technical tests wouldn't prove it. They'll always be convinced.

What we need from the government is so minimal really, just to sign certificates if we prove our identity. But it'll never happen in the US due to the distrust situation.

Re: Short session expiration does not help security

#348

Post by xp84 »

npunt wrote: post #309
actuallyalys wrote: post #186

The main place I see short session expirations is on banking and financial apps, which seems defensible to me for a couple of reasons: 1) They're used by a wide variety of people, including people who may not own a computer or mobile device, or who may not have a backup device to use when their personal device breaks. This group is probably shrinking—more and more people have smartphones and the remaining people who…

Health services also log you out after ~15min. Kaiser, One Medical, Epic Mychart, etc. Very annoying

Some of my highest-paranoia sites and apps are things like my dental insurance. Yeah guys, hackers are out to get me and they can't wait to impersonate me and reschedule my next cleaning for an inconvenient time!

Re: Short session expiration does not help security

#349

Post by paulmooreparks »

My favorite example of putting security ahead of usability:

"Unexpected item in bagging area. Please remove item from bagging area." "Item removed from bagging area. Please wait: an attendant will be with you shortly."

This one sets me off because I worked in the self-checkout division.

The simplest way for stores to improve customer satisfaction and increase usage of self-checkout was to disable the bagging scale and accept that there would always be a certain level of "shrink," or grocery item theft.

Re: Short session expiration does not help security

#350

Post by breadwinner »

If the account is for accessing employer's system then sessions have to be kept short, and users have to re-login every day. Otherwise employees who have left the company would continue to access the system.

The reason Google never expires your session is because they want to track your activity and connect your activity to your account. This is not a good system to copy.

Post reply on HN