Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Frequent reauth doesn't make you more secure

tailscale.com

Post reply on HN
Print view View original

451–460 of 539 posts

Re: Frequent reauth doesn't make you more secure

#451

Post by kiitos »

jjav wrote: post #149
kiitos wrote: post #37

Earlier quoted context omitted.

No modern IT organization mandates periodical password changes since, I dunno, mid-2000's. edit : please note the "modern" qualifier, tons of IT orgs continue to mandate this anachronistic policy, sure, but those orgs aren't modern, the policy isn't a requirement for e.g. SOC2 or whatever, it's purely historical inertia.

> the policy isn't a requirement for e.g. SOC2 or whatever It is a PCI requirement and probably from other sources. Of course it is brain dead and we even have authoritative documentation from NIST explaining why it is stupid, but nobody at PCI has any technical skills to understand that so the madness lives on.

It is for sure not a PCI requirement that user system passwords need to be changed on any kind of interval. At least, I've been a member of several PCI-compliant organizations that did not have or enforce this policy.

Re: Frequent reauth doesn't make you more secure

#452

Post by lesuorac »

BitwiseFool wrote: post #450
chillfox wrote: post #421

Earlier quoted context omitted.

The requirements usually don’t come from IT. It’s usually on the checklist for some audit that the organisation wants because it lowers insurance premiums or credit card processing fees. In some cases it’s because an executive believes it will be good evidence for them having done everything right in case of a breach. Point being the people implementing it usually know it’s a bad idea and so do the people asking for…

I belonged to an organization that had password complexity requirements. That's normal and understandable. However one requirement was that no part of my password could contain a three character subsstring that was included in my full name. I won't give my real name here, but sadly it includes some three letter subsequences that are somewhat common in many English words. I can understand a policy that prevents someon…

> Turns out, this rule was not from IT. It was a requirement from the cybersecurity insurance policy the organization had taken.

I wonder if some of these constraints are to try to find a way not to pay out on the policy.

Re: Frequent reauth doesn't make you more secure

#453

Post by kiitos »

qualeed wrote: post #422
ExoticPearTree wrote: post #401

Earlier quoted context omitted.

We had to prove we have a password expiration policy for a compliance audit, showed them that MS recommends not to have passwords expire and the NIST guidance and the auditors were supper happy.

Several frameworks are (finally) catching up to modern day understanding, and have either forgone the requirement for password rotation or have various exemptions if other technical measures are in place. But I agree, for those that haven't changed, it's incredibly frustrating to hamstring your own security so that you can pass a compliance or security audit. I obviously don't know which framework you are auditing ag…

Seconded, to repeat an earlier comment, I've been a member of multiple organizations that satisfied SOC2 and PCI and etc. without requiring password rotation...

Re: Frequent reauth doesn't make you more secure

#455

Post by yawaramin »

zer00eyz wrote: post #35
dheera wrote: post #26

Earlier quoted context omitted.

Frequent reauth only makes people figure out hacks to work around it. Passwords get written down, passwords end up in Google Docs, Arduinos with servos get attached to Yubikeys, SMS gets forwarded to e-mail, TOTP codes get sent over Wechat, the whole works

Because much of what passes as "security" is a bunch of theater. > SMS gets forwarded to e-mail, TOTP codes get sent over Wechat, Here we are deep into 2FA land. Where you have institutions blocking SMS/MMS to IP telephony because they want to capture real people (and this locks out rural customers). Using your cell phone was never a suitable 2nd factor and now it is evolving into a check to make sure you're not a ro…

> The police department getting a court order and forcing you to unlock your phone

If you live under a tyrannical regime, neither passkeys nor passwords will help you. The police state will find a way to do what they want with you.

Re: Frequent reauth doesn't make you more secure

#457

Post by bunderbunder »

ajmurmann wrote: post #449
ToucanLoucan wrote: post #427

Earlier quoted context omitted.

Just an unbreakable law of the universe. "Why did this stupid shit happen? Oh, it's money again."

It's not money but inertia of very large systems. All these password changes cost money as well. If anything it's a market failure that insurance companies seem to have too little incentive to update their security requirements. This would likely be solved by reducing friction with both evaluating insurers in detail and switching between them.

It's also a sort of moral hazard problem.

If you, the person in charge of these decisions, allow an incumbent policy - even a bad one - to stand, then if something goes wrong you can blame the policy. If you change the policy, though, then you're at risk of being held personally responsible if something goes wrong. Even if the change isn't related to the problem.

It's not just cybersecurity. I have a family member who was a medical director, and ran up against it whenever he wanted to update hospital policies and standards of care to reflect new findings. Legal would throw a shitfit about it every time. With the way tort law in the US works, the solution to the trolley problem is always "don't throw the switch" because as soon as you touch it you're involved and can be held responsible for what happens.

Re: Frequent reauth doesn't make you more secure

#458

Post by radicality »

frankish wrote: post #321
kevincox wrote: post #195

Earlier quoted context omitted.

I despise this. With username and password my password manager just fills it in and it is one click to click "login". With email magic link I need to enter my email (it seems to rarely auto-fill for some reason), then wait (often it takes 10s for the email to be sent for some reason), then if I was logging in on something that isn't my default browser I need to copy+paste the link (often just clicking the link author…

My preferred workflow as well, but now many websites are starting to do this thing where you have to enter only your username, hit next, and then the password input shows up; however, the username only input breaks my password manager from trying to autofill! Argh

HomeDepot’s is even crazier. You input just your email and hit Next. Then a button appears to “Send magic link” to login via that annoying method. And then there is a tiny text below: “Want to use a different login method? Wait 10s…9s…8s…”. Only after 10s are you able to select a tiny text link “Use Password” to unlock using the password field

Re: Frequent reauth doesn't make you more secure

#459

Post by apitman »

catlifeonmars wrote: post #419
apitman wrote: post #320

Earlier quoted context omitted.

OAuth2 is not inherently stateless.

Good call. I said OAuth but what I meant was OIDC and specifically JWT. OAuth (not OIDC) implementations MAY use opaque access tokens that require server side state to validate.

Ah makes sense

Re: Frequent reauth doesn't make you more secure

#460

Post by Terretta »

princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

This is not Apple's intended default behavior.

The various stores use their own biometric auth (the abstraction over touch ID and face ID) settings, which can cause this based on user config, particularly if you're using family accounts of any kind.

The most likely issue is one of these is set to ask every time as many families that share devices with kids consider that a feature, not a bug.

If all possible places are set to accept biometric ID (there's always one more setting than you think to check), it can be something about your network or device itself, particularly if for some reason you show up as if rotating through random geographies or from "unknown" devices.

Modern-ish auth systems (e.g., authentication mechanisms for Google, Microsoft, and Apple) also have a "risk based authentication" ratchet that re-prompts if enough data points are abnormal. Depending on your level of access to admin panels, you may be able to identify what is flagging to re-prompt.

Usually this sort of thing can be traced to something like a per-request VPN with no geographic affinity option, or an ISP (especially mobile ISP) that exits you from random cities across border lines.

Post reply on HN