5 ms·
Giving your cookies short timeouts, say 5 minutes, and including the client's ip address in the cookie are both mitigating techniques.
by jacobsenscott 5y ago
Giving your cookies short timeouts, say 5 minutes, and including the client's ip address in the cookie are both mitigating techniques.
- ubercow13 5y agoSo you would be signed out of Slack every 5 minutes?
- theshrike79 5y agoNo, Slack would reauthenticate every 5 minutes. It doesn't mean that the user needs to do anything.
- kleinsch 5y agoIf you closed Slack for more than 5 mins, you’d get signed out. Users would hate it, which is why nobody does this.
- SV_BubbleTime 5y agoSo, the alternative should be "don't trust anything in slack because someone can just get your cookie and log in as you"? Maybe there is a middle ground?
- kleinsch 5y agoThe middle ground is the SSO reauth interval, where companies can decide that for greater security they’ll made you reauth every 8 hours, daily, weekly etc to balance it against user pain. Companies do this today already.
- charcircuit 5y agoWho closes slack for more than 5 minutes though? My desktop slack is pretty much running 24/7.
- oarsinsync 5y agoNo, the client would need to renew the cookie every 2.5 mins (similar approach to DHCP leases). If the external IP has changed, the cookie should not be renewed. If it's expired already, it should not be renewed. This wont work, though, as nobody wants to sign in once per day. That's too inconvenient.
- halestock 5y agoFor customers, yes, but I've worked at places where we required employees to re-auth daily (if not more frequently).
- throw_away 5y agoI worked at a place where re-auth was required every twelve hours, which was a convenient reminder of when you'd been working way too long.
- sneak 5y agoIf you are using SSO (to enforce U2F) and password managers (really, basic levels of enterprise auth competence in 2021) then signing in multiple times per day isn't a huge hassle because it's just a click and a tap.
- deleted 5y ago[deleted]
- paxys 5y agoISPs (especially mobile ones) sometimes rotate IP addresses in an little as 4 hours. Relying on static IP addresses throughout a client session might be more secure but will result in people getting logged out very frequently. Plus, even with the most strict filtering client IP addresses can always be spoofed.
- roywashere 5y agoEncoding the IP as part of the session is not very common practice as many people switch their devices between different wifi networks and mobile
- rileyteige 5y agoMAC address would work for this, no? Wouldn't solve the spoofing but solves the dynamic IP address issue.
- IiydAbITMvJkqKf 5y agoMAC addresses are not exposed to web sites, and for good reason. It would be the mother of all supercookies.
- charcircuit 5y agoWouldn't a supercookie like that make things more secure though? You could even use it for fingerprinting to help combat things like spam.
- stedaniels 5y agoMAC addresses aren't sent over the Internet.
- jaywalk 5y agoMAC address cannot be seen past your local gateway.
- jacobsenscott 5y agoSpoofing an IP address is easy. Receiving the packets sent to that address when you don't control that address - not so easy.
- mcpherrinm 5y agoSlack is used for long term communication. If I’m walking around town on my phone, I absolutely don’t want slack to get logged out every time I connect to some wifi network.