Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Frequent reauth doesn't make you more secure

tailscale.com

Post reply on HN
Print view View original

381–390 of 539 posts

Re: Frequent reauth doesn't make you more secure

#381

Post by vachina »

paxys wrote: post #41
princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

And it's even worse if you are accessing Apple services on a non-Apple device. No matter how many times I click "trust device" when logging in to icloud.com it will still make me do the password + one-time code song and dance the next day. Another pointless annoyance - if Face ID fails when making a payment or installing an app (like it frequently does for reasons like sleeping in bed or wearing sunglasses) it won't…

Dismiss the password prompt and reinitiate the auth, FaceID will work again. I’m not sure why Apple doesn’t let us retry FaceID on the get go, but at least theres this method.

Re: Frequent reauth doesn't make you more secure

#382

Post by claudex »

pcardoso wrote: post #377
SAI_Peregrinus wrote: post #270

Earlier quoted context omitted.

Does anyone not add the year & month of the last password change to the end of their password? E.g. PascalCasePassphraseGoesHere2025-06, then at the next required change in (for example) 6 months: PascalCasePassphraseGoesHere2026-01. It almost certainly fits the inane "letter, number, and special character" requirements they probably have, complies with "different from your last X passwords", and is easy to keep trac…

I once wrote a script to change my password randomly X times and then back to my original password. Worked like a charm.

There are policies to prevent changing the password more than once a day to prevent that. I've encountered it in several places

Re: Frequent reauth doesn't make you more secure

#383

Post by RealStickman_ »

account42 wrote: post #379
mooreds wrote: post #298

Earlier quoted context omitted.

Another common reason to do a force password reset is if they've moved authentication providers and were not able to bring their hashes along. Some providers don't allow for hash export (Cognito, Entra).

Or just if they changed to a more secure hash algorithm themselves and want to upgrade users still on the older insecure one.

They could do that by comparing against the old hash and if it matches generate the new hash to store somewhere.

Re: Frequent reauth doesn't make you more secure

#384

Post by arccy »

apitman wrote: post #240
whiplash451 wrote: post #168

Earlier quoted context omitted.

In 2025, I don’t think that accessing apple accounts on a non-apple device is a happy path for apple anymore.

"Trust this device" is the modern day elevator door close button.

I've found that it's only american elevator door close buttons that don't work.

The rest of the world manages to keep them operational.

Re: Frequent reauth doesn't make you more secure

#385

Post by arccy »

steadicat wrote: post #274
lxgr wrote: post #94

Earlier quoted context omitted.

This is why 24 hours is a particularly bad timespan for reauthentication. With e.g. 16 hours, you’d at least get a predictable prompt on each new workday.

One time I led a project and ran daily standups by screen-sharing our Asana board so the team could review in-progress tasks. Every day, right in the middle of the meeting, Asana logged me out. I’d rush to log back in to finish the review, thus ensuring we’d repeat the cycle exactly 24 hours later. This silly dance lasted the whole project.

Didn't you take weekends off?

Re: Frequent reauth doesn't make you more secure

#386

Post by afiori »

Xss3 wrote: post #366
montebicyclelo wrote: post #189

Forced password rotation and expiry seems the bigger problem; given that it causes people to get locked out so often, (e.g. if pw expires when on holiday), — often then requiring travelling to IT, or at least a few hours trying to get IT on the phone to reset, or chasing up colleagues who aren't locked out to get in touch with IT. Many (most?) companies still do it, despite it now not being recommended by NIST: > Ver…

Hot take, password requirements are a necessity to prevent id10t errors. Another hot take, calling them passwords instead of pass phrases was a mistake. People have no problem making a secure pass phrase like 'apophis is coming in 2029’. It uses special chars and numbers, but some websites would reject it for spaces and some for being too long. I say these are hot takes despite aligning with NIST because I've never s…

"password too long" for password shorter than a megabyte is the most idiotic error ever created.

It only makes sense in HTTP basicauth and other system that keep plaintext passwords.

Re: Frequent reauth doesn't make you more secure

#388

Post by falcor84 »

Y_Y wrote: post #244
olddustytrail wrote: post #120

Earlier quoted context omitted.

I saw the best minds of my generation destroyed by madness, starving hysterical naked, dragging themselves through the negro streets at dawn looking for an angry fix

How is that supposed to make anyone click on an ad?

Just to expand upon the reference, the comment you responded to is the first stanza of Allen Ginsberg poem "Howl" [0] published in 1956, which is what Hammerbacher paraphrased in the quote that I shared. "Howl" is amazing on its own though, and I highly recommend that people read the whole thing and/or watch the 2010 film about Ginsberg's life where James Franco recites it in its entirety[1]. And as a follow-up, I also highly recommend Scott Alexander's "Meditations on Moloch" that takes inspiration from the poem to analyze societal failures of coordination.

[0] https://www.poetryfoundation.org/poems/49303/howl

[1] https://www.imdb.com/title/tt1049402/

[2] https://slatestarcodex.com/2014/07/30/meditations-on-moloch/

Re: Frequent reauth doesn't make you more secure

#390

Post by blueflow »

account42 wrote: post #379
mooreds wrote: post #298

Earlier quoted context omitted.

Another common reason to do a force password reset is if they've moved authentication providers and were not able to bring their hashes along. Some providers don't allow for hash export (Cognito, Entra).

Or just if they changed to a more secure hash algorithm themselves and want to upgrade users still on the older insecure one.

This can be done at login time without the user noticing, as you have the plaintext password for a moment.
Post reply on HN