Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Frequent reauth doesn't make you more secure

tailscale.com

Post reply on HN
Print view View original

91–100 of 539 posts

Re: Frequent reauth doesn't make you more secure

#91

Post by baggy_trough »

socalgal2 wrote: post #51
princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

Also, every time I plug my iPhone into my Mac for syncing it asks "Trust this Device" both the Mac and the iPhone. I click "yes" and yet it asks again next time.

This is seriously annoying.

Re: Frequent reauth doesn't make you more secure

#92

Post by hamburglar »

CamperBob2 wrote: post #74
princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

I'm not surprised that it occasionally prompts for a password (about once or twice a week for me), because otherwise people will forget their passwords and bug them about it. The problem I have is that it doesn't explain who wants the password or why, and the prompts aren't associated with any particular action on my part. Instead, Apple is conditioning people to mindlessly type in their password on demand. Why in th…

Yes, it’s really bad for security. I just deny it if I don’t know what it’s for. I’m sure I’m missing out on some very important functionality.

Re: Frequent reauth doesn't make you more secure

#93

Post by [deleted] »

jadamson wrote: post #56
thaumasiotes wrote: post #55

Earlier quoted context omitted.

Session cookies are cookies that identify a session. They last however long you specify. A bank forces quick session expiry. Amazon doesn't. Compare https://docs.djangoproject.com/en/5.2/topics/http/sessions/ . > To use cookies-based sessions, set the SESSION_ENGINE setting to "django.contrib.sessions.backends.signed_cookies". > When using the cookies backend the session data can be read by the client. > A MAC (Messa…

No, they're not. This terminology is well-established. https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Coo...

[deleted]

Re: Frequent reauth doesn't make you more secure

#94

Post by lxgr »

eddythompson80 wrote: post #84
0xQSL wrote: post #69

My employer just started doing daily reauth for all microsoft logins (teams, ...). The worst thing is that it's just 24h not start of day, so it may just be five seconds before you want to join a meeting. They haven't found the setting for mobile yet, so I might just stop using desktop teams.

Had that on the WiFi system at a facility I used to work from for a while. When you connect to their WiFi, you go to a guest portal to connect to the internet. The guest portal grants your MAC address 24 hours of access. Meaning one day you get to work at 9, the next day you get in at 8:55, you’ll have 5 minutes more of WiFi before things just stop working and your system takes a minute to realize you need to reauth…

This is why 24 hours is a particularly bad timespan for reauthentication. With e.g. 16 hours, you’d at least get a predictable prompt on each new workday.

Re: Frequent reauth doesn't make you more secure

#95

Post by ziml77 »

quesera wrote: post #70
MBCook wrote: post #43

Earlier quoted context omitted.

Really? I never have to re-auth unless I get a new device.

Same behavior here. I use TouchID to log in several times per day, and am required to enter a password "to enable TouchID" about once per week. iOS and macOS both. This feels reasonable to me.

It's annoying to ever have to enter a password manually, but it does make sense every 1 or 2 weeks to force it. Not even as a security thing but as a memory thing. It's incredible how something that you seem to know so well can get flushed from your memory after you stop recalling that knowledge regularly.

Re: Frequent reauth doesn't make you more secure

#96

Post by lxgr »

paxys wrote: post #39

Industry-wide IT security is driven by the "nobody got fired for buying IBM" phenomenon. It doesn't matter if things are broken. It matters that you did everything by the book. And the book in this case was written 30 years ago and is woefully inadequate. But try convincing your VP of information security that employees shouldn't have to change their password every 3 months...

At least for that one, you can now point to NIST recommendations, which finally discourage rotating passwords.

Re: Frequent reauth doesn't make you more secure

#97

Post by [deleted] »

thaumasiotes wrote: post #78
jadamson wrote: post #56

Earlier quoted context omitted.

No, they're not. This terminology is well-established. https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Coo...

You can believe what you like, but that won't change what people mean by the term "session cookie". If you try to communicate with other people using that definition of "session cookie", your communication will fail.

[deleted]

Re: Frequent reauth doesn't make you more secure

#98

Post by CamperBob2 »

hamburglar wrote: post #92
CamperBob2 wrote: post #74

Earlier quoted context omitted.

I'm not surprised that it occasionally prompts for a password (about once or twice a week for me), because otherwise people will forget their passwords and bug them about it. The problem I have is that it doesn't explain who wants the password or why, and the prompts aren't associated with any particular action on my part. Instead, Apple is conditioning people to mindlessly type in their password on demand. Why in th…

Yes, it’s really bad for security. I just deny it if I don’t know what it’s for. I’m sure I’m missing out on some very important functionality.

My understanding is that iCloud backup requires it, among who-knows-what other things. So I've been reluctant to hit "Not now."

I just have to trust their security model to not allow random apps to pop up and issue those prompts.

Re: Frequent reauth doesn't make you more secure

#99

Post by Xevion »

sircastor wrote: post #65
princevegeta89 wrote: post #36

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this o…

I have a very old iPad that my kid uses. It’s stuck to iOS 10.3. Also, it can’t use my password manager. The browser is so old that the website won’t load (32-bit app). And the PW manager app isn’t made for this old a device. So Apple wants me to type in my 50+ character password every time I use the App Store app. It’s such a pain.

Then why'd you pick a 50+ character password? No one made you do that. That's your fault, not Apple's.

- As you said, it's a multi-platform account, so probably multiple devices in multiple locations will need the password. Meaning you won't have easy access to your password manager. - Popular account, so you'll likely be using it often, probably re-typing or pasting it.

Common sense says that manually typing out a password was a likely scenario.

Switch to a phrase-based password. It'll still be really secure, and you'll be freed from your self-inflicted woes.

Re: Frequent reauth doesn't make you more secure

#100

Post by mikepurvis »

paxys wrote: post #79
sircastor wrote: post #65

Earlier quoted context omitted.

I have a very old iPad that my kid uses. It’s stuck to iOS 10.3. Also, it can’t use my password manager. The browser is so old that the website won’t load (32-bit app). And the PW manager app isn’t made for this old a device. So Apple wants me to type in my 50+ character password every time I use the App Store app. It’s such a pain.

If it helps there's no security advantage of a 50+ character password over a suitable 16 character one.

Remember how 1Password used to install itself as a custom keyboard that could "type" your passwords into arbitrary text fields anywhere in the OS, before password management specific hooks were added?

It would be nifty if your phone could just connect to other devices as a BT keyboard and type in passwords there too. Probably not worth the actual fuss of pairing a BT device, but if that part were not so painful it could be quite a nice solution.

Post reply on HN