Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Frequent reauth doesn't make you more secure

tailscale.com

Post reply on HN
Print view View original

61–70 of 539 posts

Re: Frequent reauth doesn't make you more secure

#61

Post by tonymet »

al_borland wrote: post #46
tonymet wrote: post #33

Yahoo published these findings over 20 years ago , that frequent re-auth made customers less secure because it encouraged poor password hygiene like short passwords, writing them down, etc. It's also risky to have the primary password credential transmitted instead of temporary tokens.

On the side of things, the risk of never needing your password is people tend to forget it. Just the other week I was helping someone setup a TV and they thought they didn’t have an Amazon login, because they never needed to login. This was a Prime member. 1Password defaults to having users reauthenticate every 2 weeks. I do find this a bit annoying, but I find the occasional reminder of my password to be a necessity…

It's a good point on password usability. Signal app periodically prompts you for the encryption PIN to make sure you don't forget it.

I think this should be handled out of band of the login process. Similar to "is xxx still your phone number?" -- companies could do periodic password hygiene and freshness checks.

Context matters. Companies forget that people are trying to get something important done, and blocking them for other attention is a huge frustration.

Re: Frequent reauth doesn't make you more secure

#62

Post by 0xQSL »

LordDragonfang wrote: post #42

There's supreme irony with Tailscale being the one posting this -- because one of my biggest annoyances with the service is that, afaict, there's no way to set up a device so that it never expires. I just had two devices - one of which was my main server - I was using it with require re-auth out of nowhere and break one of my workflows. If I had not already set up separate remote access to the server, it would have b…

There's "disable key expiry" per machine in the tailscale admin panel

Re: Frequent reauth doesn't make you more secure

#63

Post by twodave »

The people who need to read these articles are the auditors. Until they change their expectations, the many businesses who have to pass audits are still going to be stuck doing a lot of things that are industry-standard but also very stupid. This is the case even for small businesses in certain fields where security audits are valued. We have at least half a dozen measures in place that we know aren't actually helpful but we also know auditors won't budge on right now.

Re: Frequent reauth doesn't make you more secure

#64

Post by falcor84 »

grishka wrote: post #57
socalgal2 wrote: post #51

Earlier quoted context omitted.

Also, every time I plug my iPhone into my Mac for syncing it asks "Trust this Device" both the Mac and the iPhone. I click "yes" and yet it asks again next time.

Remembering things reliably must be the most unsolvable problem in computer science. Unless it's related to advertising. Then it works flawlessly and sometimes survives device transfers and factory resets.

"The best minds of my generation are thinking about how to make people click ads."

-Jeff Hammerbacher

Re: Frequent reauth doesn't make you more secure

#65

Post by sircastor »

princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

I have a very old iPad that my kid uses. It’s stuck to iOS 10.3. Also, it can’t use my password manager. The browser is so old that the website won’t load (32-bit app). And the PW manager app isn’t made for this old a device.

So Apple wants me to type in my 50+ character password every time I use the App Store app. It’s such a pain.

Re: Frequent reauth doesn't make you more secure

#66

Post by 1718627440 »

grishka wrote: post #49
princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

Also, on both macOS and Android, there's a time component to device unlocking. You would sometimes get this stupid "your password is required to enable touch ID" or "extra security required, pattern not used in a while" thing with no way to disable it. It's beyond infuriating to me. It's my device. It should not tell me what to do. I get to tell it what to do and it obeys, unquestionably. I'll evaluate my own risks,…

> macOS and Android

> It's my device.

There is your dissonance.

Re: Frequent reauth doesn't make you more secure

#67

Post by freedomben »

kevin_thibedeau wrote: post #28
antihero wrote: post #24

Earlier quoted context omitted.

This is why you have refresh tokens - your actual token expires regularly, but the client has a token that allows you to get a new one. Revoking is a case of not allowing them to get a new one.

That's a great way to interfere with local work when the network goes down.

If you've built a local app that has to authenticate you against a remote web service even when offline, and all the actual work is being done locally, you have much bigger design issues than authn IMHO

Re: Frequent reauth doesn't make you more secure

#68

Post by nijave »

al_borland wrote: post #46
tonymet wrote: post #33

Yahoo published these findings over 20 years ago , that frequent re-auth made customers less secure because it encouraged poor password hygiene like short passwords, writing them down, etc. It's also risky to have the primary password credential transmitted instead of temporary tokens.

On the side of things, the risk of never needing your password is people tend to forget it. Just the other week I was helping someone setup a TV and they thought they didn’t have an Amazon login, because they never needed to login. This was a Prime member. 1Password defaults to having users reauthenticate every 2 weeks. I do find this a bit annoying, but I find the occasional reminder of my password to be a necessity…

Our work SSO is set to 12/24 hours in most places which seems like a decent compromise. Auth once a day

In a corporate environment, ideally your workstation password is tied to SSO and you have a short but reasonable lockscreen timeout where you need to re-type your password.

Re: Frequent reauth doesn't make you more secure

#69

Post by 0xQSL »

My employer just started doing daily reauth for all microsoft logins (teams, ...). The worst thing is that it's just 24h not start of day, so it may just be five seconds before you want to join a meeting.

They haven't found the setting for mobile yet, so I might just stop using desktop teams.

Re: Frequent reauth doesn't make you more secure

#70

Post by quesera »

MBCook wrote: post #43
princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

Really? I never have to re-auth unless I get a new device.

Same behavior here.

I use TouchID to log in several times per day, and am required to enter a password "to enable TouchID" about once per week. iOS and macOS both.

This feels reasonable to me.

Post reply on HN