5 ms·
The idea of “adaptive security” is compelling. E.g. my bank makes me type my password and sends 2fa codes when initiating/approving wire transfers… even when I
by cj 3y ago
The idea of “adaptive security” is compelling.
E.g. my bank makes me type my password and sends 2fa codes when initiating/approving wire transfers… even when I just logged in a minute ago. If I’m doing 2 wire transfers in a row, it doesn’t care, it still has me fully reauthenticate for every wire transfer.
But I’m fine with that because moving money is something that I’m willing to accept however many roadblocks are thrown at me.
But do I want that happening when I go to post a tweet? Absolutely not.
In other words, let’s adopt the concept of refreshing authentication upon particularly sensitive user actions and have lax requirements in other cases.
We don’t need to think of sessions as “logged in” or “logged out”. It’s possible to design a system where you’re always logged in forever, but you need to reauthenticate based on certain rules or actions given the context of the app and risk/threat.
- horsawlarway 3y agoAgreed - this is a much better approach. The "session" that can do the normal daily tasks for users should last as long as you can make it. The "session" that can do things like change 2fa/billing/contact-info (decidedly not-normal things) should last for exactly as long as it takes you to complete that form, and should require your pass/2fa again to touch. This is currently Google's approach, and I find it much more sane.
- konschubert 3y agoGitHub does this too.
- ahtihn 3y ago> But I’m fine with that because moving money is something that I’m willing to accept however many roadblocks are thrown at me. Really? I'd change banks over that. If I log into my e-banking website, the main activity I'm going to do is pay bills. I would absolutely not tolerate having to jump through hoops to do it.
- cj 3y agoThis is our business account so we're moving anywhere from $20k to $200k at a time. In the spirit of adaptive security, someone moving $100k will probably be fine dealing with a couple extra password / 2fa prompts... but I agree it would be annoying to deal with this for day-to-day (consumer) bill pay. A bank could throw fewer roadblocks when paying a $500 invoice vs. a $50,000 invoice The workflow I described also is part of a dual-approval model where a finance person sets up the transfer and it's approved by a 2nd person (who's presented with a bunch of authentication/password/2fa prompts, almost to a fault). But again, I'm fine with it because it's large amounts of money in corporate bank accounts. But yea, agreed it would be annoying and should be toned down in a consumer use case.
- ilyt 3y agoMy bank does that but also: * logs out after 10 minutes of inactivity - so doing anything that involved switching between accounting app and it is annoying * not allowing more than one tab open at once - that's just stupid in its entirety.