9 ms·

Only Persistent LogIn

90 points by avodonosov 4y ago

encryptluks2 4y ago
For Workspace, you can set a timeout to automatically log you out after a certain time. I'm not sure if this feature exists for regular accounts though, however even if it did it will not accomplish what you're suggesting which is to only remember you until you restart your computer. If you want to do that, then opening in a private window is the correct solution. There also exists extensions and apps that can delete session data automatically, and Chrome has policies you can specify to only remember cookies for specific sites.
classichasclass 4y ago
This is why Firefox containers are so useful. I have a Google container for exactly this reason.
- brokenmachine 4y ago
  How does the container help? Do you set that google container to automatically delete the cookies on exit?
  - Ayesh 4y ago
    > delete cookies on exit Containers are similar to browser profiles, except that history, bookmarks, HSTS, saved passwords, and everything else apart from cookies and other persistent data are "containerlized". There are addons that introduce the concept of "temporary containers", that delete all cookies when you quit that container. Google Container makes sure that every connection to Google domains (including YouTube) use a Google-specific container. This is the case for recaptcha and other probes Google has.
  - chowells 4y ago
    You only log in to google in one container. You use that container only for google. In every other container, you're not logged in.
- e40 4y ago
  The reviews for this addon are scary, honestly. Doesn't seem like there is any sort of sync. That's a deal killer for me. https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/reviews/?score=1 https://addons.mozilla.org/en-US/firefox/addon/multi-account...
  - jedberg 4y ago
    I'm not sure why you'd need sync. The whole point is to isolate every website.
  - leovander 4y ago
    Originally it wouldn't sync across your signed in Firefox Accounts, the plugin would come across but not your saved containers/open with options. I feel like they might have added having your container settings being synced more recently though.
  - forgotpwd16 4y ago
    >The reviews for this addon are scary This just verifies my expectation that reviews giving the lowest score tend to be stupid.
  - RunSet 4y ago
    Be nice if there was a Firefox "No Pocket / No Hello / No Kitchen Sync / Just-a-Web-Browser-Without-Any-Bundled-Crap Edition".
nostromo 4y ago
"Remember me" is an out-of-date concept. If you do use a shared device, you should be using your own user profile on that device. Or, at least, your own browser profile. You really shouldn't be logging into your sensitive accounts from a public device or computer anyway. Unchecking "remember me" will not make that secure, and to suggest otherwise is a bit misleading.
- avodonosov 4y ago
  > that is my computer
- falcolas 4y ago
  > You really shouldn't be logging into your sensitive accounts from a public device anyway. This kind of functionality is required, for at least one reason: public access to computers in public libraries. So long as some government services can only be accessed online, you will need access to private email accounts from publicly available computers. Logout after session end is quite useful in that situation, even if only as a backup to manually logging out.
  - cortesoft 4y ago
    I think most libraries completely reset sessions between users. Way too much liability otherwise.
    - fashiontechguru 4y ago
      The software most of them use to manage that is atrociously counter to being user-friendly.
      - ed25519FUUU 4y ago
        Why is it atrocious? From a user’s perspective it’s simple and friendly: you click log out and you’re logged out of everything.
      - 4y ago
happyopossum 4y ago
This isn't a persistent login, as is demonstrated by the fact that you're being asked to authenticate again in this window. This is simply Google skipping the 'enter your email' text box, which I'd imagine most people are happy about.
- avodonosov 4y ago
  Not asked. You can close the browser, open it and access the account without any authentication. Simply speaking, persistent cookies are used unconditionally, while in the past the unchecked "remember me" was setting session cookie instead. The first screenshot (the one with user name already filled) is when you explicitly log out and then login again.
  - happyopossum 4y ago
    You have a every specific, and not very accurate set of assumptions about what a ‘remember me’ checkbox does (hint, it’s not always session extension - it’s often just remembering your login ID). Also, you are regularly asked to authenticate to google services, and presented with the screen shown. To pretend otherwise is just weird. You can complain about the default session length, but that’s a much more specific and different rant from the one in TFA. Also, do you really think the 99.8% of regular gmail and YouTube users want to log in to google every time they close their browser windows?
rajeshp1986 4y ago
They probably ran some analytics and found majority of users use the same device and for them "Remember Me" is an annoyance. I honestly want to see more companies adopt this. It is a broken experience when you open a site and it asks you to login again on the same device, given you used the site not long ago on the same device. I want the sites to haver a robust security in the backend systems but not make users do the work for them.
- avodonosov 4y ago
  > It is a broken experience when you open a site and it asks you to login again on the same device This only happens if user explicitly unchecked the "remember me" (aka 'stay signed-in") checkbox. As such, it's a good experience - fulfilling the user request.
- Eleison23 4y ago
  "Remember me" (aka "Trust this Device") is a red herring for me in nearly every case. I suspect this is partly due to my pervasive use of IPv6; both my Android device and Windows receive IPv6 allocations on my home WiFi. The device fingerprinting that providers use seems to be fooled when the IPv6 Interface ID changes, even if the /64 is identical. So according to their algorithms, my device is perpetually new and untrusted. Live.com always always pops a dialog to ask me whether I wish to remain logged in; I never remain logged in, but the dialog constantly asks and there's no way for me to dismiss it permanently. The only time I've seen "Remember me" work properly is when it sets a cookie with my username and does nothing else. Since I use a password manager, I have no use for remembering my username, and in fact it disrupts my flow and presents an unnecessary leak of credential information.
qwerty456127 4y ago
I just clear all the browser persistent data every time I leave. It probably is possible to recover the cookies using some low-level unerase tools but this still feels better than nothing.
- lucb1e 4y ago
  Do you mean private navigation mode, or an add-on like Cookie AutoDelete? (Which deletes a lot more than just cookies, btw.)
  - qwerty456127 4y ago
    I use everything you mentioned plus I manually go to the browser settings and clean everything explicitly every day.
thoweui4o2343 4y ago
If you're logged-in, it allows Google to bypass the low-fidelity third-party cookie tracking (that's increasingly being blocked) and use GAIA id instead.
- vore 4y ago
  What is GAIA ID?
  - jvolkman 4y ago
    Gaia is the name of Google's shared user management system.
- hakfoo 4y ago
  I assumed that's the real takeaway-- they don't really want you logging out if they can avoid it. I was highly annoyed by the "persistent login via Chrome" thing, because it feels like it breaks the expected seperation of concerns-- the stuff inside the browser frame should stay inside the browser frame.
quadrifoliate 4y ago
User rant: I hate where this new Internet is going. Instead of having a username and a few secure hardware tokens that I can use to log in from any internet cafe [1] on the planet, I am now subjected to a barrage of suspicious "Is this you? Is this really you? Are you sure this is you?" inquiries every time I so much as take a trip out of state. It seems like the next step will be a requirement to show a Government ID every time I access the Internet from outside my house. "Passwords are insecure" is not a good enough rebuttal to this, honestly. We have far more robust authentication methods available; and it's possible to make them standard and avoid this "Remember me" nonsense. Instead, we get all of it for what seems to be the sole purpose of even more user tracking. ---------------------------------------- [1] Remember those? A refresher if you don't: https://www.youtube.com/watch?v=iWssRVJgPqc https://www.youtube.com/watch?v=iWssRVJgPqc
- jrockway 4y ago
  One aspect we're not thinking about is the customer service cost to a world without passwords. If you forget your password, they just email you a new one. What happens if you lose your bank's 2FA token and miss a payment deadline? "Too bad so sad," is the HN answer, but customers will move their money elsewhere. So now you need a budget for a call center, replacing hardware tokens with overnight shipping, and the "oops we'll pay the late fee for you", at least in the early days. (Once it's "normal" then those benefits will go away, but who is going to keep their money in a bank where they need to carry around something on their keychain, and if they lose it, they lose all their money? Nobody. You have to really smooth over the jarring transition, and that's expensive.) Meanwhile "are you sure it's you?" questions are free; pay a software engineer to write them, never touch it again, no matter how many customers you have. So I guess the question you have to answer, is how can a company make more money off of you by changing how you authenticate? If you show them the $$, they'll show you the WebAuthn.
  - fashiontechguru 4y ago
    That makes me think of all the people who say they avoid staying in NYC homeless shelters because their shoes get stolen. How does a yubikey work for people who are in situations where they can’t reliably hang on to a single possession? Who provides customer service to people who only scrape together a few dollars a day? Hardware 2FA isn’t much of a solution for people who don’t even qualify to rent a P.O. Box.
mgraczyk 4y ago
This is more secure overall. The problem with short sessions is that users who do not think about them sign in more often. This makes typing your credentials more normal and makes phishing attacks more common. Reducing the rate at which users enter credentials is generally a good thing. Users who are thinking about having a short session know how to clear site history when they are done, or click "sign out".
- avodonosov 4y ago
  Well, my interest is exactly to enter the password more often, so that I do not forget it. Your reasoning is questionable. Fishing attacks more likely? Maybe yes, maybe no. I personally am very cautios of any login initiated from email and other messages. I do not know how to clear site history (how?), and do not want whole history cleared; it is useful to have login names saved, for example. I only want an option to not keep the browser signed-in persistently. Manual sign-out from every site I have in many browser tabs is not practically reliable.
  - 0xbadcafebee 4y ago
    Use a password manager and you'll never have to remember it!
  - ed25519FUUU 4y ago
    If you can remember it then it’s probably not a very secure password.
benknight87 4y ago
I used to come to HN for more even-tempered high-IQ discussion but it seems to be devolving into the toxicity that ruins all online forums i.e. being outraged about something from a very limited perspective, accusing big corporation of evil-doing, and generally not appreciating the nuances of a complex problem.
- lucb1e 4y ago
  Might I suggest commenting on said missed nuances in the relevant subthread(s) rather than unconstructively blaming the community of being bad now as a whole?
- newbieuser 4y ago
  I don't think there is a culture of discussion here. If you write something that the majority does not like, they are very likely to attack you directly.
Taniwha 4y ago
"Not your computer? Use a Private Window to sign in." Really needs a ! rather than a ?
JacobSeated 4y ago
Persistent sessions are not a problem – not having any security could be (E.g. Auto logout on location or IP change, and especially two-factor authentication on various actions), but that would still be depending on the user and various circumstances. The lowest common denominator should not be defining our security practices. Point is, it is a huge bad practice to automatically log people out without their consent to do so, and it is one of the most horrific annoyances on the sites that do it. I am not even sure I want that kind of bullshit on my banking accounts, since they got two-factor authorization on account actions anyway. I can not count the amount of times I have lost something I was writing because a site logged me out before I could finish what I was doing.
chrismorgan 4y ago
My complaint is precisely the opposite: most places that have “remember me” checkboxes have nerfed them to the point of genuine uselessness, and way too many services don’t even pretend to let you stay logged in for more than ten minutes and aggressively log you out with no notice. All in clear violation of WCAG, I might add, which conventionally has at least some legal weight in a number of countries.

90 points by avodonosov 4y ago

For Workspace, you can set a timeout to automatically log you out after a certain time. I'm not sure if this feature exists for regular accounts though, however even if it did it will not accomplish what you're suggesting which is to only remember you until you restart your computer. If you want to do that, then opening in a private window is the correct solution. There also exists extensions and apps that can delete session data automatically, and Chrome has policies you can specify to only remember cookies for specific sites.

classichasclass 4y ago

This is why Firefox containers are so useful. I have a Google container for exactly this reason.

brokenmachine 4y ago
How does the container help? Do you set that google container to automatically delete the cookies on exit?
- Ayesh 4y ago
  > delete cookies on exit Containers are similar to browser profiles, except that history, bookmarks, HSTS, saved passwords, and everything else apart from cookies and other persistent data are "containerlized". There are addons that introduce the concept of "temporary containers", that delete all cookies when you quit that container. Google Container makes sure that every connection to Google domains (including YouTube) use a Google-specific container. This is the case for recaptcha and other probes Google has.
- chowells 4y ago
  You only log in to google in one container. You use that container only for google. In every other container, you're not logged in.
e40 4y ago
The reviews for this addon are scary, honestly. Doesn't seem like there is any sort of sync. That's a deal killer for me. https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/reviews/?score=1 https://addons.mozilla.org/en-US/firefox/addon/multi-account...
- jedberg 4y ago
  I'm not sure why you'd need sync. The whole point is to isolate every website.
- leovander 4y ago
  Originally it wouldn't sync across your signed in Firefox Accounts, the plugin would come across but not your saved containers/open with options. I feel like they might have added having your container settings being synced more recently though.
- forgotpwd16 4y ago
  >The reviews for this addon are scary This just verifies my expectation that reviews giving the lowest score tend to be stupid.
- RunSet 4y ago
  Be nice if there was a Firefox "No Pocket / No Hello / No Kitchen Sync / Just-a-Web-Browser-Without-Any-Bundled-Crap Edition".

nostromo 4y ago

"Remember me" is an out-of-date concept. If you do use a shared device, you should be using your own user profile on that device. Or, at least, your own browser profile. You really shouldn't be logging into your sensitive accounts from a public device or computer anyway. Unchecking "remember me" will not make that secure, and to suggest otherwise is a bit misleading.

avodonosov 4y ago
> that is my computer
falcolas 4y ago
> You really shouldn't be logging into your sensitive accounts from a public device anyway. This kind of functionality is required, for at least one reason: public access to computers in public libraries. So long as some government services can only be accessed online, you will need access to private email accounts from publicly available computers. Logout after session end is quite useful in that situation, even if only as a backup to manually logging out.
- cortesoft 4y ago
  I think most libraries completely reset sessions between users. Way too much liability otherwise.
  - fashiontechguru 4y ago
    The software most of them use to manage that is atrociously counter to being user-friendly.
    - ed25519FUUU 4y ago
      Why is it atrocious? From a user’s perspective it’s simple and friendly: you click log out and you’re logged out of everything.
    - 4y ago

happyopossum 4y ago

This isn't a persistent login, as is demonstrated by the fact that you're being asked to authenticate again in this window. This is simply Google skipping the 'enter your email' text box, which I'd imagine most people are happy about.

avodonosov 4y ago
Not asked. You can close the browser, open it and access the account without any authentication. Simply speaking, persistent cookies are used unconditionally, while in the past the unchecked "remember me" was setting session cookie instead. The first screenshot (the one with user name already filled) is when you explicitly log out and then login again.
- happyopossum 4y ago
  You have a every specific, and not very accurate set of assumptions about what a ‘remember me’ checkbox does (hint, it’s not always session extension - it’s often just remembering your login ID). Also, you are regularly asked to authenticate to google services, and presented with the screen shown. To pretend otherwise is just weird. You can complain about the default session length, but that’s a much more specific and different rant from the one in TFA. Also, do you really think the 99.8% of regular gmail and YouTube users want to log in to google every time they close their browser windows?

rajeshp1986 4y ago

They probably ran some analytics and found majority of users use the same device and for them "Remember Me" is an annoyance. I honestly want to see more companies adopt this. It is a broken experience when you open a site and it asks you to login again on the same device, given you used the site not long ago on the same device. I want the sites to haver a robust security in the backend systems but not make users do the work for them.

avodonosov 4y ago
> It is a broken experience when you open a site and it asks you to login again on the same device This only happens if user explicitly unchecked the "remember me" (aka 'stay signed-in") checkbox. As such, it's a good experience - fulfilling the user request.
Eleison23 4y ago
"Remember me" (aka "Trust this Device") is a red herring for me in nearly every case. I suspect this is partly due to my pervasive use of IPv6; both my Android device and Windows receive IPv6 allocations on my home WiFi. The device fingerprinting that providers use seems to be fooled when the IPv6 Interface ID changes, even if the /64 is identical. So according to their algorithms, my device is perpetually new and untrusted. Live.com always always pops a dialog to ask me whether I wish to remain logged in; I never remain logged in, but the dialog constantly asks and there's no way for me to dismiss it permanently. The only time I've seen "Remember me" work properly is when it sets a cookie with my username and does nothing else. Since I use a password manager, I have no use for remembering my username, and in fact it disrupts my flow and presents an unnecessary leak of credential information.

qwerty456127 4y ago

I just clear all the browser persistent data every time I leave. It probably is possible to recover the cookies using some low-level unerase tools but this still feels better than nothing.

lucb1e 4y ago
Do you mean private navigation mode, or an add-on like Cookie AutoDelete? (Which deletes a lot more than just cookies, btw.)
- qwerty456127 4y ago
  I use everything you mentioned plus I manually go to the browser settings and clean everything explicitly every day.

thoweui4o2343 4y ago

If you're logged-in, it allows Google to bypass the low-fidelity third-party cookie tracking (that's increasingly being blocked) and use GAIA id instead.

vore 4y ago
What is GAIA ID?
- jvolkman 4y ago
  Gaia is the name of Google's shared user management system.
hakfoo 4y ago
I assumed that's the real takeaway-- they don't really want you logging out if they can avoid it. I was highly annoyed by the "persistent login via Chrome" thing, because it feels like it breaks the expected seperation of concerns-- the stuff inside the browser frame should stay inside the browser frame.

quadrifoliate 4y ago

User rant: I hate where this new Internet is going. Instead of having a username and a few secure hardware tokens that I can use to log in from any internet cafe [1] on the planet, I am now subjected to a barrage of suspicious "Is this you? Is this really you? Are you sure this is you?" inquiries every time I so much as take a trip out of state. It seems like the next step will be a requirement to show a Government ID every time I access the Internet from outside my house. "Passwords are insecure" is not a good enough rebuttal to this, honestly. We have far more robust authentication methods available; and it's possible to make them standard and avoid this "Remember me" nonsense. Instead, we get all of it for what seems to be the sole purpose of even more user tracking. ---------------------------------------- [1] Remember those? A refresher if you don't: https://www.youtube.com/watch?v=iWssRVJgPqc https://www.youtube.com/watch?v=iWssRVJgPqc

jrockway 4y ago
One aspect we're not thinking about is the customer service cost to a world without passwords. If you forget your password, they just email you a new one. What happens if you lose your bank's 2FA token and miss a payment deadline? "Too bad so sad," is the HN answer, but customers will move their money elsewhere. So now you need a budget for a call center, replacing hardware tokens with overnight shipping, and the "oops we'll pay the late fee for you", at least in the early days. (Once it's "normal" then those benefits will go away, but who is going to keep their money in a bank where they need to carry around something on their keychain, and if they lose it, they lose all their money? Nobody. You have to really smooth over the jarring transition, and that's expensive.) Meanwhile "are you sure it's you?" questions are free; pay a software engineer to write them, never touch it again, no matter how many customers you have. So I guess the question you have to answer, is how can a company make more money off of you by changing how you authenticate? If you show them the $$, they'll show you the WebAuthn.
- fashiontechguru 4y ago
  That makes me think of all the people who say they avoid staying in NYC homeless shelters because their shoes get stolen. How does a yubikey work for people who are in situations where they can’t reliably hang on to a single possession? Who provides customer service to people who only scrape together a few dollars a day? Hardware 2FA isn’t much of a solution for people who don’t even qualify to rent a P.O. Box.

mgraczyk 4y ago

This is more secure overall. The problem with short sessions is that users who do not think about them sign in more often. This makes typing your credentials more normal and makes phishing attacks more common. Reducing the rate at which users enter credentials is generally a good thing. Users who are thinking about having a short session know how to clear site history when they are done, or click "sign out".

avodonosov 4y ago
Well, my interest is exactly to enter the password more often, so that I do not forget it. Your reasoning is questionable. Fishing attacks more likely? Maybe yes, maybe no. I personally am very cautios of any login initiated from email and other messages. I do not know how to clear site history (how?), and do not want whole history cleared; it is useful to have login names saved, for example. I only want an option to not keep the browser signed-in persistently. Manual sign-out from every site I have in many browser tabs is not practically reliable.
- 0xbadcafebee 4y ago
  Use a password manager and you'll never have to remember it!
- ed25519FUUU 4y ago
  If you can remember it then it’s probably not a very secure password.

benknight87 4y ago

I used to come to HN for more even-tempered high-IQ discussion but it seems to be devolving into the toxicity that ruins all online forums i.e. being outraged about something from a very limited perspective, accusing big corporation of evil-doing, and generally not appreciating the nuances of a complex problem.

lucb1e 4y ago
Might I suggest commenting on said missed nuances in the relevant subthread(s) rather than unconstructively blaming the community of being bad now as a whole?
newbieuser 4y ago
I don't think there is a culture of discussion here. If you write something that the majority does not like, they are very likely to attack you directly.

Taniwha 4y ago

"Not your computer? Use a Private Window to sign in." Really needs a ! rather than a ?

JacobSeated 4y ago

Persistent sessions are not a problem – not having any security could be (E.g. Auto logout on location or IP change, and especially two-factor authentication on various actions), but that would still be depending on the user and various circumstances. The lowest common denominator should not be defining our security practices. Point is, it is a huge bad practice to automatically log people out without their consent to do so, and it is one of the most horrific annoyances on the sites that do it. I am not even sure I want that kind of bullshit on my banking accounts, since they got two-factor authorization on account actions anyway. I can not count the amount of times I have lost something I was writing because a site logged me out before I could finish what I was doing.

chrismorgan 4y ago

My complaint is precisely the opposite: most places that have “remember me” checkboxes have nerfed them to the point of genuine uselessness, and way too many services don’t even pretend to let you stay logged in for more than ten minutes and aggressively log you out with no notice. All in clear violation of WCAG, I might add, which conventionally has at least some legal weight in a number of countries.