Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Frequent reauth doesn't make you more secure

tailscale.com

Post reply on HN
Print view View original

71–80 of 539 posts

Re: Frequent reauth doesn't make you more secure

#71

Post by thway15269037 »

I hate how prevalent it has become and it's getting even worse. One company that is buying our product has enforced SSO in theirs installation, making access_token lifetime of 15 seconds and refresh_token 4 minutes. For those unaware of OIDC/OAuth/SSO terminology, basically it means "if you lost access to internet for 4 minutes, invalidate your session, invalidate everything, make user go to auth, pick up 2fa, input everything...".

It causes incredible amount of stress in end users, who keep spamming us with tickets how our product logs out them every minute, like when they closed laptop for a minute, went from one building to another or when their VPN simply lost connection while they were on a lunch. It's like hundreds tickets per day when normally it's 3-4 per week.

And you can't really do anything about it, because "muh security standards", "we need to pass audit" and whatever.

I actually want to sit down and calculate how much working hours of everyone involved are wasted every single day, day after day, it's completely bonkers.

Re: Frequent reauth doesn't make you more secure

#72

Post by icedchai »

kiitos wrote: post #37
paxys wrote: post #16

Corporate IT still makes you change your password every N months. Tell them to extend the max session length beyond a day and some VP will have an aneurysm.

No modern IT organization mandates periodical password changes since, I dunno, mid-2000's. edit : please note the "modern" qualifier, tons of IT orgs continue to mandate this anachronistic policy, sure, but those orgs aren't modern, the policy isn't a requirement for e.g. SOC2 or whatever, it's purely historical inertia.

I have one that emails me every 3 months to change my password. Very annoying.

Re: Frequent reauth doesn't make you more secure

#73

Post by ars »

antihero wrote: post #24
d4mi3n wrote: post #7

Frequent reauth doesn't meaningfully improve your security posture (unless you have a very, very long expiry), but any auth system worth it's salt should have the capability to revoke a session, either via expiry or by user/device. In practice, I find that the latency between when you want to revoke a session to when that session no longer has access to anything is more important than how often you force reauthentica…

This is why you have refresh tokens - your actual token expires regularly, but the client has a token that allows you to get a new one. Revoking is a case of not allowing them to get a new one.

You only have to do that if you must validate a token, without having access to session data.

I doubt most systems are like that, you can just use what you call "your actual token" and check if the session is still valid. Adding a second token is rarely needed unless you have disconnected systems that can't see session data.

Re: Frequent reauth doesn't make you more secure

#74

Post by CamperBob2 »

princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

I'm not surprised that it occasionally prompts for a password (about once or twice a week for me), because otherwise people will forget their passwords and bug them about it.

The problem I have is that it doesn't explain who wants the password or why, and the prompts aren't associated with any particular action on my part. Instead, Apple is conditioning people to mindlessly type in their password on demand. Why in the world are they doing a stupid, dangerous, counterproductive thing like that?

Re: Frequent reauth doesn't make you more secure

#75

Post by yard2010 »

grishka wrote: post #49
princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

Also, on both macOS and Android, there's a time component to device unlocking. You would sometimes get this stupid "your password is required to enable touch ID" or "extra security required, pattern not used in a while" thing with no way to disable it. It's beyond infuriating to me. It's my device. It should not tell me what to do. I get to tell it what to do and it obeys, unquestionably. I'll evaluate my own risks,…

This is just enshitification in a mask. Next thing you know, guess what? Your device is not yours, you just rent it from the feudal.

Re: Frequent reauth doesn't make you more secure

#76

Post by qualeed »

inglor_cz wrote: post #58
kiitos wrote: post #37

Earlier quoted context omitted.

No modern IT organization mandates periodical password changes since, I dunno, mid-2000's. edit : please note the "modern" qualifier, tons of IT orgs continue to mandate this anachronistic policy, sure, but those orgs aren't modern, the policy isn't a requirement for e.g. SOC2 or whatever, it's purely historical inertia.

My Microsoft account is definitely bothersome like this. I never searched for the root cause (tenant policies? some default value somewhere?), but I have to refresh my password every 4 months or so.

It's a setting in the admin.microsoft.com portal (Org settings -> Security & privacy -> Password expiration policy).

The setting, funny enough, is literally "Set passwords to never expire (recommended)".

They also link to "Learn why passwords that never expire are more secure" in the same place.

Anyone who is forcing expiry is specifically going against recommended policies (Microsoft's, NIST's, and any serious security person) for some reason or other.

Re: Frequent reauth doesn't make you more secure

#77

Post by nijave »

Spooky23 wrote: post #23

Only if you make a bunch of assumptions that may not apply. My employer allows BYO and has a default Outlook Web session timeout. Is it ok that my son stopped at my desk at home and saw customer PII that was left open? I enforce these kinds of policies at my company even though I find them personally stupid. I do so because I’m the custodian of my customers property and have a duty to minimize risk of employees or co…

>Is it ok that my son stopped at my desk at home and saw customer PII that was left open?

In practice/reality, probably. Most employers will disagree.

Consider your son could just as easily over hear a phone call, see a piece of paper, etc. If your son was actively malicious, there's all kinds of things from cameras to video splitters to key loggers he could do. If he's not actively malicious, who cares if he sees something

If you're in a line of work worried about shoulder suffering, then you should really consider whether BYO is a good idea.

Re: Frequent reauth doesn't make you more secure

#78

Post by thaumasiotes »

jadamson wrote: post #56
thaumasiotes wrote: post #55

Earlier quoted context omitted.

Session cookies are cookies that identify a session. They last however long you specify. A bank forces quick session expiry. Amazon doesn't. Compare https://docs.djangoproject.com/en/5.2/topics/http/sessions/ . > To use cookies-based sessions, set the SESSION_ENGINE setting to "django.contrib.sessions.backends.signed_cookies". > When using the cookies backend the session data can be read by the client. > A MAC (Messa…

No, they're not. This terminology is well-established. https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Coo...

You can believe what you like, but that won't change what people mean by the term "session cookie".

If you try to communicate with other people using that definition of "session cookie", your communication will fail.

Re: Frequent reauth doesn't make you more secure

#79

Post by paxys »

sircastor wrote: post #65
princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

I have a very old iPad that my kid uses. It’s stuck to iOS 10.3. Also, it can’t use my password manager. The browser is so old that the website won’t load (32-bit app). And the PW manager app isn’t made for this old a device. So Apple wants me to type in my 50+ character password every time I use the App Store app. It’s such a pain.

If it helps there's no security advantage of a 50+ character password over a suitable 16 character one.

Re: Frequent reauth doesn't make you more secure

#80

Post by haiku2077 »

LordDragonfang wrote: post #42

There's supreme irony with Tailscale being the one posting this -- because one of my biggest annoyances with the service is that, afaict, there's no way to set up a device so that it never expires. I just had two devices - one of which was my main server - I was using it with require re-auth out of nowhere and break one of my workflows. If I had not already set up separate remote access to the server, it would have b…

https://tailscale.com/kb/1028/key-expiry#disabling-key-expir...
Post reply on HN