4 ms·

The author also puts lot’s of faith on the user not doing stupid things: “Is this a thing? Are shared computers without user separation a thing? If so, these s

The author also puts lot’s of faith on the user not doing stupid things: “Is this a thing? Are shared computers without user separation a thing? If so, these shouldn’t be used to access web applications with sensitive information at all, no matter how short the session expiry time is.” Yeah, users might just leave their bank logged in a open and logged computer library. That’s why short sessions exist for those as this will limit the window of opportunity for a bad actor to do something bad. Not perfect of course, but limit the exposure.

horsawlarway 3y ago
> Not perfect of course, but limit the exposure. It's a shared computer (and if the session is carrying over, it's not just shared hardware it's a shared account). In this case - you are utterly fucked if you think that machine is secure. Hell, fuck the session, I'll just run a keylogger (or if I'm not admin, install a malicious browser extension) and capture your whole login - I have considerably more access to this machine than I need to compromise you in a large number of ways.
- water9 3y ago
  And get ATM machines work every day on the principle of asking you to just re-enter your password on potentially harmful transactions. Let’s also pretend like there’s a security camera looking at my desk that is usually not monitored, but you don’t know that
- philote 3y ago
  Maybe the machine is secured by not allowing anything further to be installed on it. Or maybe it's not. I've heard most crimes are due to opportunity, so it's best to protect your users from accidentally leaving themselves logged in on a shared computer for the next person to find that opportunity.
- vidarh 3y ago
  > I'll just run a keylogger You could. But what is relevant is whether you have. The point is not to protect against a determined attacker, but to reduce the chance of an opportunistic attack. It really feels like most people have little experience with shared computer resources any more, because pranking people who left their computer unlocked used to be practically a sport, even when the same people would (mostly) never go out of their way to attack a locked down account. Screen locks became a thing long before mobile devices for a reason.
- cuu508 3y ago
  Let's say the bank also uses 2FA (say, physical code calculators) - your next step?
  - horsawlarway 3y ago
    Install system malware - wait for next login (which will be soon, since the short session is forcing repeated logins) send session token to myself. Done. Now I have an active session. Don't give a fuuuuck about that 2fa device.
    - deleted 3y ago
      [deleted]
    - hannasanarion 3y ago
      This is a bit like saying, "there's no point in having a lock on my door because somebody in my house can shoot me". The fact that an outer ring of security can't protect you from people who are already in an inner ring doesn't invalidate the outer ring. If you already own somebody enough to install whatever malware you want on their computer, then sure, session lengths aren't going to stop you, but they're also not intended to. Session lengths are intended to stop the guy at the coffee shop who grabs your computer when you go to use the bathroom.
- fnordpiglet 3y ago
  Except these public or low bar access machines are there for generally vulnerable people - elderly, homeless, migrant workers, or others who generally don’t have a dedicated machine they can secure. Most people don’t “think” about security at all, it’s beyond their education and familiarity. Banks, for instance, offer access to their services to everyone - not just hacker news readers. They’ve started adding fees to in person or phone interactions directing people who can least afford the fees towards online access, which they often don’t have direct access to. ISP fees can be expensive, computers as well, or in the case of elderly they often just don’t know how to get started and value accessing via the library. If you’re homeless you don’t have a place for an ISP subscription, and many access devices at shelters. People in jail or prison also use shared devices. Yes they’re overall very exposed to bad actors and the machines they use are really insecure. So, short lease credentials definitely reduces blast radius. If you have a key logger, but no automated account drain scripts, a 5 minute timeout will effectively prevent you unless you’re actively watching. Finally, some of these are regulatory requirements for better or worse. That doesn’t forgive the regulation, but it does sometimes explain the policy.
- hahn-kev 3y ago
  Got it, so people who aren't privileged enough to own a device shouldn't use the internet.
throwaway03626 3y ago
Another scenario is a large office. If a user leaves their desk to get a coffee, an attacker could walk up and get access. Of course, in that case they could also install key loggers, MTM software etc. so they will get access to anything they want.
qwertox 3y ago
> Users might just leave their bank logged in a open and logged computer library. Fine. Then add an option where I can press a button in order to signal the bank that I'm at a secure computer, and that I'd like to increase the session timeout to 1 hour for this one time.
grishka 3y ago
It's better to let users do stupid things so they learn from their mistakes and not do them ever again. And probably tell their story to their friends and family so they, too, don't do this. Putting all these excessive guards in place kinda encourages ignorance and tech illiteracy.
- adamckay 3y ago
  You have far too much faith in stupid people.

horsawlarway 3y ago

> Not perfect of course, but limit the exposure. It's a shared computer (and if the session is carrying over, it's not just shared hardware it's a shared account). In this case - you are utterly fucked if you think that machine is secure. Hell, fuck the session, I'll just run a keylogger (or if I'm not admin, install a malicious browser extension) and capture your whole login - I have considerably more access to this machine than I need to compromise you in a large number of ways.

water9 3y ago
And get ATM machines work every day on the principle of asking you to just re-enter your password on potentially harmful transactions. Let’s also pretend like there’s a security camera looking at my desk that is usually not monitored, but you don’t know that
philote 3y ago
Maybe the machine is secured by not allowing anything further to be installed on it. Or maybe it's not. I've heard most crimes are due to opportunity, so it's best to protect your users from accidentally leaving themselves logged in on a shared computer for the next person to find that opportunity.
vidarh 3y ago
> I'll just run a keylogger You could. But what is relevant is whether you have. The point is not to protect against a determined attacker, but to reduce the chance of an opportunistic attack. It really feels like most people have little experience with shared computer resources any more, because pranking people who left their computer unlocked used to be practically a sport, even when the same people would (mostly) never go out of their way to attack a locked down account. Screen locks became a thing long before mobile devices for a reason.
cuu508 3y ago
Let's say the bank also uses 2FA (say, physical code calculators) - your next step?
- horsawlarway 3y ago
  Install system malware - wait for next login (which will be soon, since the short session is forcing repeated logins) send session token to myself. Done. Now I have an active session. Don't give a fuuuuck about that 2fa device.
  - deleted 3y ago
    [deleted]
  - hannasanarion 3y ago
    This is a bit like saying, "there's no point in having a lock on my door because somebody in my house can shoot me". The fact that an outer ring of security can't protect you from people who are already in an inner ring doesn't invalidate the outer ring. If you already own somebody enough to install whatever malware you want on their computer, then sure, session lengths aren't going to stop you, but they're also not intended to. Session lengths are intended to stop the guy at the coffee shop who grabs your computer when you go to use the bathroom.
fnordpiglet 3y ago
Except these public or low bar access machines are there for generally vulnerable people - elderly, homeless, migrant workers, or others who generally don’t have a dedicated machine they can secure. Most people don’t “think” about security at all, it’s beyond their education and familiarity. Banks, for instance, offer access to their services to everyone - not just hacker news readers. They’ve started adding fees to in person or phone interactions directing people who can least afford the fees towards online access, which they often don’t have direct access to. ISP fees can be expensive, computers as well, or in the case of elderly they often just don’t know how to get started and value accessing via the library. If you’re homeless you don’t have a place for an ISP subscription, and many access devices at shelters. People in jail or prison also use shared devices. Yes they’re overall very exposed to bad actors and the machines they use are really insecure. So, short lease credentials definitely reduces blast radius. If you have a key logger, but no automated account drain scripts, a 5 minute timeout will effectively prevent you unless you’re actively watching. Finally, some of these are regulatory requirements for better or worse. That doesn’t forgive the regulation, but it does sometimes explain the policy.
hahn-kev 3y ago
Got it, so people who aren't privileged enough to own a device shouldn't use the internet.

throwaway03626 3y ago

Another scenario is a large office. If a user leaves their desk to get a coffee, an attacker could walk up and get access. Of course, in that case they could also install key loggers, MTM software etc. so they will get access to anything they want.

qwertox 3y ago

> Users might just leave their bank logged in a open and logged computer library. Fine. Then add an option where I can press a button in order to signal the bank that I'm at a secure computer, and that I'd like to increase the session timeout to 1 hour for this one time.

grishka 3y ago

It's better to let users do stupid things so they learn from their mistakes and not do them ever again. And probably tell their story to their friends and family so they, too, don't do this. Putting all these excessive guards in place kinda encourages ignorance and tech illiteracy.

adamckay 3y ago
You have far too much faith in stupid people.