5 ms·

You cannot use an untrusted computer to reliably log out.

xori 9y ago
Especially when the norm for refresh tokens is like, 90 days.
jessaustin 9y ago
If, as GP suggests, you have to plug a USB device in to auth the first time, why not just run the protocol through the device for every single HTTP request? Then, if the user unplugged the device, future requests would fail, right? I don't know if the protocol under discussion forbids that, but it seems like an easy change?
- djrogers 9y ago
  A USB device would only be one of many options - relying on it would be pretty backward looking.
  - jessaustin 9y ago
    Other things would have other options. You might have a bluetooth or nfc device that has a "momentary" button, that e.g. you have to press less than five seconds before any particular web request.
    - filleduchaos 9y ago
      That's a straight path to frustration on today's web
- deleted 9y ago
  [deleted]
- rapind 9y ago
  Might as well just boot linux from a USB at that point.
  - ithkuil 9y ago
    sadly just being able to boot your OS is not enough to trust the resulting hardware+OS combo
- vokep 9y ago
  maybe, a better solution might be just doing a serverside 'authenticity ping' every x seconds, and if that fails then you get kicked out. This would leave a window of x seconds after logging out in which attacks could occur but that could be mitigated by requiring a failed request on logout (perhaps require the usb key to be removed upon logout, send an auth-ping, and only give a successful logout message if the auth-ping fails. (Even without this mitigation I'm not sure what kind of attack would work for the inbetween X seconds, but might as well mitigate it in case someone else could think of something)
zrm 9y ago
> You cannot use an untrusted computer to reliably log out. You could conceivably have a login sessions page and access it from a trusted computer to force logout of a session from an untrusted computer. But it seems the bigger problem with login from a malicious computer is that the computer could do whatever it wants with your session while you're logged in, regardless of how securely you can logout later.
- adrianratnapala 9y ago
  Yes. As soon as you use an untrusted computer, there is no telling what you are vulnerable to. But: (1) people frequently (and rightly) do that anyway, so we might as well make it less bad. (2) Building a trustworthy computer is largely about isolating different components in a way that hurts malware more than it does the user-experience. Sticking keys on a USB key is one instance of such isolation.
simias 9y ago
If login becomes quicker and less disruptive it might make sense for websites to default to expiring sessions a lot faster. If all you need to do is scan your watch or press a button on your USB token it doesn't matter if you have to do it 10 times every day. If that's still not enough websites could ask for confirmation for every potentially sensitive action. Of course there's only so much you can do if your hardware is compromised, you can just try to mitigate the issue as much as possible and hope for the best.
ecesena 9y ago
Nor you can today - a completely untrusted computer could fake the logout experience and keep a valid access token. All signed access token, when logged out or revoked, should be marked so on the server side. Of course the untrusted computer should at the very least send the logout request. Typically, a service should also let you see all your active sessions and let you revoke them.

xori 9y ago

Especially when the norm for refresh tokens is like, 90 days.

If, as GP suggests, you have to plug a USB device in to auth the first time, why not just run the protocol through the device for every single HTTP request? Then, if the user unplugged the device, future requests would fail, right? I don't know if the protocol under discussion forbids that, but it seems like an easy change?

djrogers 9y ago
A USB device would only be one of many options - relying on it would be pretty backward looking.
- jessaustin 9y ago
  Other things would have other options. You might have a bluetooth or nfc device that has a "momentary" button, that e.g. you have to press less than five seconds before any particular web request.
  - filleduchaos 9y ago
    That's a straight path to frustration on today's web
deleted 9y ago
[deleted]
rapind 9y ago
Might as well just boot linux from a USB at that point.
- ithkuil 9y ago
  sadly just being able to boot your OS is not enough to trust the resulting hardware+OS combo
vokep 9y ago
maybe, a better solution might be just doing a serverside 'authenticity ping' every x seconds, and if that fails then you get kicked out. This would leave a window of x seconds after logging out in which attacks could occur but that could be mitigated by requiring a failed request on logout (perhaps require the usb key to be removed upon logout, send an auth-ping, and only give a successful logout message if the auth-ping fails. (Even without this mitigation I'm not sure what kind of attack would work for the inbetween X seconds, but might as well mitigate it in case someone else could think of something)

zrm 9y ago

> You cannot use an untrusted computer to reliably log out. You could conceivably have a login sessions page and access it from a trusted computer to force logout of a session from an untrusted computer. But it seems the bigger problem with login from a malicious computer is that the computer could do whatever it wants with your session while you're logged in, regardless of how securely you can logout later.

adrianratnapala 9y ago
Yes. As soon as you use an untrusted computer, there is no telling what you are vulnerable to. But: (1) people frequently (and rightly) do that anyway, so we might as well make it less bad. (2) Building a trustworthy computer is largely about isolating different components in a way that hurts malware more than it does the user-experience. Sticking keys on a USB key is one instance of such isolation.

simias 9y ago

If login becomes quicker and less disruptive it might make sense for websites to default to expiring sessions a lot faster. If all you need to do is scan your watch or press a button on your USB token it doesn't matter if you have to do it 10 times every day. If that's still not enough websites could ask for confirmation for every potentially sensitive action. Of course there's only so much you can do if your hardware is compromised, you can just try to mitigate the issue as much as possible and hope for the best.

ecesena 9y ago

Nor you can today - a completely untrusted computer could fake the logout experience and keep a valid access token. All signed access token, when logged out or revoked, should be marked so on the server side. Of course the untrusted computer should at the very least send the logout request. Typically, a service should also let you see all your active sessions and let you revoke them.