3 ms·
Hand waving away the threat of application use on shared devices seems a little over confident to me. This is probably not a threat for company devices, but it
by _tk_ 3y ago
Hand waving away the threat of application use on shared devices seems a little over confident to me. This is probably not a threat for company devices, but it is clearly a threat in other environments, i.e family members sharing a device. While some users might expect to be logged in all the time, others expect to be logged out after they close a web app tab.
Session expiration should be application specific. Google's sessions do not expire, so that more user data can be collected. That is clearly more valuable to them, than compromised accounts due to session hijacking. Them doing it, is not a great use case for others, because their value proposition is entirely different than for most other web applications.
- horsawlarway 3y ago> Google's sessions do not expire, so that more user data can be collected. That is clearly more valuable to them, than compromised accounts due to session hijacking. Them doing it, is not a great use case for others, because their value proposition is entirely different than for most other web applications. I think this is a pretty bad take. Google runs some very sensitive applications for paying enterprise customers, and they still tend to not expire sessions. I also really don't like Google as an ad company, and I think my trust in their judgement has fallen precipitously over the last decade, but I find it hard to compare them to someone like Microsoft and say they're doing worse on the security front (I don't think they are).
- jacquesm 3y agoBoth Google and Microsoft have world-class security teams. But Google is run in a more effective way (so fewer instances of the right hand not knowing what the left is doing) and has less legacy to lug around, it also suffers less from the innovators dilemma (for now, at least). It makes a big difference if your stuff has been designed as a web based service from day #1 or if you are required to talk to anything and everything on prem and off prem as well as in the cloud. The attack surface of a typical Microsoft enterprise product is absolutely gigantic and the fact that they do as well as they do is something to be appreciative of. That said I don't want their stuff anywhere near my company.
- galdor 3y ago> Google runs some very sensitive applications for paying enterprise customers, and they still tend to not expire sessions. For Google Workspace, web applications (e.g. Gmail or Calendar) will regularly force you to re-authenticate "for your security". It's not a daily thing fortunately, but it is common enough to be frustrating.
- nightpool 3y agoSession expiration length is a configurable setting by the domain admin, it's not enabled by default.
- ghiculescu 3y agoOh is that why it asks for re-auth all the time? I thought it was built in. Nice, I’m going to disable that.
- vel0city 3y ago> Google's sessions do not expire They kind of do. I use a lot of machines that I might only hop on once a month or so. Chrome sync often ends up in a "paused" state where I have to re-auth. YouTube will fall back to a not-signed-in profile on me and I'll need to re-auth every now and then. Loading up Gmail will have me re-auth again pretty often. Often its not a full re-auth with my security keys but it'll at least challenge a password. I get these challenges probably every week or so across all my devices.
- deleted 3y ago[deleted]
- GoblinSlayer 3y agoIf you live with a family, you don't have any security margin: an unattended computer gets the next user immediately and a lot can be done in just one minute.