Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Frequent reauth doesn't make you more secure

tailscale.com

Post reply on HN
Print view View original

411–420 of 539 posts

Re: Frequent reauth doesn't make you more secure

#411

Post by bux93 »

thyristan wrote: post #363
bux93 wrote: post #350

Earlier quoted context omitted.

Yikes, whoever wrote that should be ashamed of themselves. On the bright side, it doesn't specify how long the predefined interval should be, and says entities are to 'ensure the strength of authentication is appropriate to the classification of the asset to be accessed' - so, in order to ensure the appropriate strenght the interval should be 100 years is totally defensible IMHO. The whole paragraph doesn't take MFA…

11.3. (a) mandates multi-factor auth for priviledged and sysadmin accounts, and 11.7. requires multi-factor auth depending on criticality determinations. All in addition to whatever is in 11.6. But the thought about the non-specified intervals in 11.6. is great, nowhere in there are any numbers to be found. So basically one can do the sensible thing, set some huge numbers that are no problem in practice and everythin…

I mentioned MFA because 11.6 says to change "authentication credentials", but with MFA that could mean both factors or either. So key rotation without changing the "what you know" factor would arguably also satisfy the requirement; the term 'credentials' is not defined, and especially not defined in relation to MFA.

Re: Frequent reauth doesn't make you more secure

#412

Post by projektfu »

WarOnPrivacy wrote: post #216

From the article: Now that most OSes can unlock with just a fingerprint or face, there's no reason to leave your screen unlocked when you walk away. This statement seems to be unaware that workstations are a thing. In 30 years of onsite support, I think I've seen one desktop PC with a fingerprint scanner. Cameras aren't ubiquitous either. Across the 5 locations I currently service, less than 2 percent of desktop PCs…

If an organization wants fingerprint scanners, they just have to provide them. It's about $15-50 per workstation, if desired. The main problem is they use up an increasingly scarce USB port. Some scanners also rely more on security by obscurity rather than protecting the channel. https://www.google.com/search?q=windows%20hello%20fingerprin...

It would be worth doing research to find the best fingerprint scanner that implements this well.

Face scanning is a poor solution because desktops usually do not have Hello-compatible scanners and the scanners on the Windows laptops aren't very good. They frustrate users who prefer darkened rooms or who sit in places with varying contrast from the windows. It is also weird the way the camera is constantly trying to find you, and so it blinks its red LED frequently until the computer goes to sleep.

Just really agreeing with you on security keys, but we also have to make sure they are really secure. Also, like the article says, they give you the device possession part, but not the user ID part, unless they have a biometric device built in.

Re: Frequent reauth doesn't make you more secure

#413

Post by Retric »

imtringued wrote: post #365
Retric wrote: post #222

Earlier quoted context omitted.

I’m doubtful a 30 digit minimum password is a meaningful improvement over a 20 digit password here. Meanwhile actually typing in very long passwords adds up across a workday/year especially with mistakes.

You're only supposed to type your password at most once a day to sign into SSO.

Then how do you suggest authenticating not just in the morning but after lunch, going to the bathroom, any physical meetings, etc?

Re: Frequent reauth doesn't make you more secure

#414

Post by thih9 »

claudex wrote: post #382
pcardoso wrote: post #377

Earlier quoted context omitted.

I once wrote a script to change my password randomly X times and then back to my original password. Worked like a charm.

There are policies to prevent changing the password more than once a day to prevent that. I've encountered it in several places

Fascinating. In other words:

In order to force the user to change their password more frequently (long term), the user is prevented from changing their password too frequently (short term).

I wonder whether the person who added that is actually confident that the benefits outweigh the drawbacks or is that a case of tunnel vision.

Re: Frequent reauth doesn't make you more secure

#415

Post by btbuildem »

> Consider enforcing automatic screen lock when you walk away

The corpo "security" dingbats force this on our work machines via profiles -- can't control how long before the screen locks. Thank goodness for the Amphetamine app. I'm not typing in my password every time I stop to think for two minutes, you can fuck all the way off with that.

Re: Frequent reauth doesn't make you more secure

#416

Post by Spooky23 »

zelphirkalt wrote: post #148
nijave wrote: post #77

Earlier quoted context omitted.

>Is it ok that my son stopped at my desk at home and saw customer PII that was left open? In practice/reality, probably. Most employers will disagree. Consider your son could just as easily over hear a phone call, see a piece of paper, etc. If your son was actively malicious, there's all kinds of things from cameras to video splitters to key loggers he could do. If he's not actively malicious, who cares if he sees so…

"Shoulder suffering" a funny one ; )

In fairness, accurate. Anyone choosing to read my work email is certainly embracing suffering.

Re: Frequent reauth doesn't make you more secure

#417

Post by Y_Y »

falcor84 wrote: post #388
Y_Y wrote: post #244

Earlier quoted context omitted.

How is that supposed to make anyone click on an ad?

Just to expand upon the reference, the comment you responded to is the first stanza of Allen Ginsberg poem "Howl" [0] published in 1956, which is what Hammerbacher paraphrased in the quote that I shared. "Howl" is amazing on its own though, and I highly recommend that people read the whole thing and/or watch the 2010 film about Ginsberg's life where James Franco recites it in its entirety[1]. And as a follow-up, I al…

Thanks for adding the background, much more helpful than my glib nonsense.

I feel that Meditations on Moloch should be mandatory study for anyone who lives in a society.

Re: Frequent reauth doesn't make you more secure

#418

Post by thih9 »

dspillett wrote: post #399
valleyer wrote: post #304

Earlier quoted context omitted.

Um, that's a really bad sign...

Not if the check is done client-side, so the plain password never leaves you local domain. Of course the check being done client-side means that it isn't difficult to skip if you are inclined to make a smidgin of effort.

It can be done server side too, the old password can be sent along the new one and the server can verify it.

Re: Frequent reauth doesn't make you more secure

#419

Post by catlifeonmars »

apitman wrote: post #320
catlifeonmars wrote: post #226

Earlier quoted context omitted.

Having a short session expiry is a workaround for not being able to revoke a token in real time. This is really the fault of stateless auth protocols (like OAuth) which do offline authentication by design. This allows authentication to scale in federated identity contexts.

OAuth2 is not inherently stateless.

Good call. I said OAuth but what I meant was OIDC and specifically JWT. OAuth (not OIDC) implementations MAY use opaque access tokens that require server side state to validate.

Re: Frequent reauth doesn't make you more secure

#420

Post by delfinom »

deathanatos wrote: post #297
SAI_Peregrinus wrote: post #270

Earlier quoted context omitted.

Does anyone not add the year & month of the last password change to the end of their password? E.g. PascalCasePassphraseGoesHere2025-06, then at the next required change in (for example) 6 months: PascalCasePassphraseGoesHere2026-01. It almost certainly fits the inane "letter, number, and special character" requirements they probably have, complies with "different from your last X passwords", and is easy to keep trac…

I just let the keyring roll a completely new password. For some reason, all of my employers do require this insanity, but not on the one password I have to actually type.

They do it because their IT departments are checklist monkeys with no actual brainpower there, AND/OR they have cybersecurity insurers that mandate it who also have nobody with actual brainpower working there.
Post reply on HN