Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Frequent reauth doesn't make you more secure

tailscale.com

Post reply on HN
Print view View original

51–60 of 539 posts

Re: Frequent reauth doesn't make you more secure

#51

Post by socalgal2 »

princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

Also, every time I plug my iPhone into my Mac for syncing it asks "Trust this Device" both the Mac and the iPhone. I click "yes" and yet it asks again next time.

Re: Frequent reauth doesn't make you more secure

#52

Post by bgirard »

The flip side of this is that I had a Ring doorbell in a home I lived in. Moved out and split up with my ex. Years later I installed a new Ring doorbell and I got a message from her shortly after installing it saying she was getting notifications again from my new Ring camera.

Kind of scary now to wonder if there's any loose accounts somewhere that's leaking sensitive information due to never requiring reauth.

I think the worse offender is iMessage. It's very easy to not understand that your SMS messages are -sometimes- going over icloud and can be seen on old apple devices you might have given up. I tried to unregister my phone number from iMessage about 5 times and it just doesn't work for me.

Re: Frequent reauth doesn't make you more secure

#53

Post by gsa »

cosmic_cheese wrote: post #11
lapcat wrote: post #4

OMG I wish that someone would tell this to Apple. Apple's developer services, such as App Store Connect, actually use session cookies. It's infuriating.

Google’s the one I have the most trouble with in this regard. The more things you sign into the worse it gets, seemingly, which really sucks if for example you’ve got a bunch of Android test devices and simulators sharing test accounts. A high profile example is how on the WAN Show, Linus or Luke always get booted out of the show Google Doc and have to sign back in at some point during.

Google is pretty frustrating. I switch between my desktop and laptop frequently and sometimes browsers as well. The reauth dialog pops up two weeks for every login - usually just when I'm about to hop on a meeting.

Re: Frequent reauth doesn't make you more secure

#54

Post by nijave »

staplers wrote: post #48
kiitos wrote: post #37

Earlier quoted context omitted.

No modern IT organization mandates periodical password changes since, I dunno, mid-2000's. edit : please note the "modern" qualifier, tons of IT orgs continue to mandate this anachronistic policy, sure, but those orgs aren't modern, the policy isn't a requirement for e.g. SOC2 or whatever, it's purely historical inertia.

Is this rage bait?

Yes

Re: Frequent reauth doesn't make you more secure

#55

Post by thaumasiotes »

paxys wrote: post #8
andrewmcwatters wrote: post #5

Earlier quoted context omitted.

Uh, session cookies being one of the most fundamental pieces of authentication tech, there's nothing wrong with them. This is like saying, "example.com actually uses HTTPS. It's infuriating." Do you mean that you have to reauth across domains? Those still use session cookies. Edit: I'm dating myself here, but as far as I can tell apparently sometime between 2010 and 2011, developers started referring to session cooki…

No, sites use persistent cookies , which remain on your browser after you have closed the tab. Session cookies are wiped out automatically after every session.

Session cookies are cookies that identify a session. They last however long you specify. A bank forces quick session expiry. Amazon doesn't.

Compare https://docs.djangoproject.com/en/5.2/topics/http/sessions/ .

> To use cookies-based sessions, set the SESSION_ENGINE setting to "django.contrib.sessions.backends.signed_cookies".

> When using the cookies backend the session data can be read by the client.

> A MAC (Message Authentication Code) is used to protect the data against changes by the client, so that the session data will be invalidated when being tampered with. The same invalidation happens if the client storing the cookie (e.g. your user’s browser) can’t store all of the session cookie and drops data.

Re: Frequent reauth doesn't make you more secure

#56

Post by jadamson »

thaumasiotes wrote: post #55
paxys wrote: post #8

Earlier quoted context omitted.

No, sites use persistent cookies , which remain on your browser after you have closed the tab. Session cookies are wiped out automatically after every session.

Session cookies are cookies that identify a session. They last however long you specify. A bank forces quick session expiry. Amazon doesn't. Compare https://docs.djangoproject.com/en/5.2/topics/http/sessions/ . > To use cookies-based sessions, set the SESSION_ENGINE setting to "django.contrib.sessions.backends.signed_cookies". > When using the cookies backend the session data can be read by the client. > A MAC (Messa…

No, they're not. This terminology is well-established.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Coo...

Re: Frequent reauth doesn't make you more secure

#57

Post by grishka »

socalgal2 wrote: post #51
princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

Also, every time I plug my iPhone into my Mac for syncing it asks "Trust this Device" both the Mac and the iPhone. I click "yes" and yet it asks again next time.

Remembering things reliably must be the most unsolvable problem in computer science.

Unless it's related to advertising. Then it works flawlessly and sometimes survives device transfers and factory resets.

Re: Frequent reauth doesn't make you more secure

#58

Post by inglor_cz »

kiitos wrote: post #37
paxys wrote: post #16

Corporate IT still makes you change your password every N months. Tell them to extend the max session length beyond a day and some VP will have an aneurysm.

No modern IT organization mandates periodical password changes since, I dunno, mid-2000's. edit : please note the "modern" qualifier, tons of IT orgs continue to mandate this anachronistic policy, sure, but those orgs aren't modern, the policy isn't a requirement for e.g. SOC2 or whatever, it's purely historical inertia.

My Microsoft account is definitely bothersome like this. I never searched for the root cause (tenant policies? some default value somewhere?), but I have to refresh my password every 4 months or so.

Re: Frequent reauth doesn't make you more secure

#60

Post by NoMoreNicksLeft »

They've got the google mail here at work set to make me change the password once per month. The 100-character, unguessable, un-shoulder-surfable password that isn't reused anywhere. In addition to the 2fa I have to use with it. And it will now ask for reauth once per week, which just happens to somehow be 2 minutes before the important weekly meeting I'm supposed to attend which kicks me out of calendar for the link to the Google video meeting.

But at least it makes me reauth.

Post reply on HN