3 ms·

I use one website semi regularly that has what feels like a 5 minute session expiration, but is actually probably 10 minutes. The session expires even if you ar

I use one website semi regularly that has what feels like a 5 minute session expiration, but is actually probably 10 minutes. The session expires even if you are actively using it. Drives me nuts. But not nuts enough to write in and complain. Maybe I should send them this article ;-)

nidble 3y ago
Let me guess... is it a bank? One of mine's does it (expires session after a few minutes, even actively using it). I find that bank websites usually follow completely opposite ways regarding to security than any other industry: very short passwords, only digits, not encrypted in db (some sites ask for single positions), mandatory password input by virtual keyboard, cannot use password managers, not using 2FA or only allowing SMS instead of TOTP or other methods, etc...
- rrrpfb11 3y ago
  Re single positions, my bank requires a password (which one hopes is appropriately hashed and so forth) plus a challenge to supply requested offsets into a secret phrase. That mitigates I suppose against over the shoulder attack. And they have fewer requirements of the phrase so maybe it’s less likely to be written down? I’m curious whether there’s a technical means to allow the challenge by offset without storing the phrase plain text. I’m challenged for four positions - in theory it could store hashes of all possible four offsets, but is there a better way?
  - GoblinSlayer 3y ago
    Split the secret into characters then compute verifier bytes for each character: verifier[i]=hash(pepper,salt,i,secret[i])[0]
eclipticplane 3y ago
Is it... American Express? It's the only site that will log me out _while trying to pay my bill_. And forget trying to use American Express Travel. I have written in to complain, but have only gotten "It's for security reasons" hand waving in reply.

3 ms·

I use one website semi regularly that has what feels like a 5 minute session expiration, but is actually probably 10 minutes. The session expires even if you ar

by irrational 3y ago

nidble 3y ago
Let me guess... is it a bank? One of mine's does it (expires session after a few minutes, even actively using it). I find that bank websites usually follow completely opposite ways regarding to security than any other industry: very short passwords, only digits, not encrypted in db (some sites ask for single positions), mandatory password input by virtual keyboard, cannot use password managers, not using 2FA or only allowing SMS instead of TOTP or other methods, etc...
- rrrpfb11 3y ago
  Re single positions, my bank requires a password (which one hopes is appropriately hashed and so forth) plus a challenge to supply requested offsets into a secret phrase. That mitigates I suppose against over the shoulder attack. And they have fewer requirements of the phrase so maybe it’s less likely to be written down? I’m curious whether there’s a technical means to allow the challenge by offset without storing the phrase plain text. I’m challenged for four positions - in theory it could store hashes of all possible four offsets, but is there a better way?
  - GoblinSlayer 3y ago
    Split the secret into characters then compute verifier bytes for each character: verifier[i]=hash(pepper,salt,i,secret[i])[0]
eclipticplane 3y ago
Is it... American Express? It's the only site that will log me out _while trying to pay my bill_. And forget trying to use American Express Travel. I have written in to complain, but have only gotten "It's for security reasons" hand waving in reply.