3 ms·

Once the attacker knows they can steal the session ID, and how long it will be valid for. It’s just a matter of running a script to do that all that as fast as

by water9 3y ago

Once the attacker knows they can steal the session ID, and how long it will be valid for. It’s just a matter of running a script to do that all that as fast as possible.

klodolph 3y ago
That’s one possible scenario. The correct way to evaluate security is to consider many different scenarios, and consider how your mitigations affect the likelihoods of all of them, weighted by their impact.
- horsawlarway 3y ago
  > The correct way to evaluate security is to consider many different scenarios, and consider how your mitigations affect the likelihoods of all of them, weighted by their impact. NO! that's merely the FIRST step in evaluating security. The next steps are: What sort of threat am I attempting to prevent? How do my mitigations impact usefulness of the product on the whole? And most critically: Are my users better served by adding this security measure? That is much more likely to be determined based on what the product/tool is trying to achieve. Which brings us right back to: Security is a tradeoff. There are situations where I think short sessions make sense (ex: changing billing/contact info). There are also situations where short sessions are huge negatives (ex: how well is slack going to work if you get logged out every 15 minutes?) My proposal is simple: Actually do the damn evaluation, instead of just blindly siding with "moar security = moar better!"
  - marcus0x62 3y ago
    > My proposal is simple: Actually do the damn evaluation, instead of just blindly siding with "moar security = moar better!" Agree 100% on this.
hinkley 3y ago
I will posit this proposition: Short sessions are thinking like physical security. Someone can pick any lock, the question is will it take long enough for a human to interrupt the attack? It doesn’t matter how long a computer has access to the key. How fast it can cause damage is limited by the speed of light, not human fingers. If you ever leave the credentials where they are accessible, they can be used even if the session expires in three seconds. And if they’re being seen (in motion) why would the session be expiring in three seconds? Machines hack differently than humans. Don’t think in human timeframes or orders of magnitude. That will let you make mistakes you can’t afford to make.
- marcus0x62 3y ago
  > Machines hack differently than humans. An awful lot of hacking is done manually, by humans. For many scenarios, considering human timeframes is completely reasonable.
  - hinkley 3y ago
    We live in a world where real time advertising auctions happen. If you think there’s something about that which can’t apply to organized crime you’re gonna be in for a rude awakening when your systems start to fail en masse. I’ve had to replace a credit card twice for suspicious activity (once cost me my favorite domain name, which is still parked). There were no major charges in either case. One charge at a business I’ve never been to. Some people get a card and use it. Some immediately sell it after proving it works. That means a clearing house. A food chain. That will get more automated, not less.
    - marcus0x62 3y ago
      Sure, there are some attacker activities that are highly automated. That’s not what we’re talking about here. We’re talking about compromised temporal session tokens, which are frequently harvested by manual action, and in those scenarios, thinking about human timeframes is very useful.

by water9 3y ago

Once the attacker knows they can steal the session ID, and how long it will be valid for. It’s just a matter of running a script to do that all that as fast as possible.

klodolph 3y ago

That’s one possible scenario. The correct way to evaluate security is to consider many different scenarios, and consider how your mitigations affect the likelihoods of all of them, weighted by their impact.

horsawlarway 3y ago
> The correct way to evaluate security is to consider many different scenarios, and consider how your mitigations affect the likelihoods of all of them, weighted by their impact. NO! that's merely the FIRST step in evaluating security. The next steps are: What sort of threat am I attempting to prevent? How do my mitigations impact usefulness of the product on the whole? And most critically: Are my users better served by adding this security measure? That is much more likely to be determined based on what the product/tool is trying to achieve. Which brings us right back to: Security is a tradeoff. There are situations where I think short sessions make sense (ex: changing billing/contact info). There are also situations where short sessions are huge negatives (ex: how well is slack going to work if you get logged out every 15 minutes?) My proposal is simple: Actually do the damn evaluation, instead of just blindly siding with "moar security = moar better!"
- marcus0x62 3y ago
  > My proposal is simple: Actually do the damn evaluation, instead of just blindly siding with "moar security = moar better!" Agree 100% on this.

hinkley 3y ago

I will posit this proposition: Short sessions are thinking like physical security. Someone can pick any lock, the question is will it take long enough for a human to interrupt the attack? It doesn’t matter how long a computer has access to the key. How fast it can cause damage is limited by the speed of light, not human fingers. If you ever leave the credentials where they are accessible, they can be used even if the session expires in three seconds. And if they’re being seen (in motion) why would the session be expiring in three seconds? Machines hack differently than humans. Don’t think in human timeframes or orders of magnitude. That will let you make mistakes you can’t afford to make.

marcus0x62 3y ago
> Machines hack differently than humans. An awful lot of hacking is done manually, by humans. For many scenarios, considering human timeframes is completely reasonable.
- hinkley 3y ago
  We live in a world where real time advertising auctions happen. If you think there’s something about that which can’t apply to organized crime you’re gonna be in for a rude awakening when your systems start to fail en masse. I’ve had to replace a credit card twice for suspicious activity (once cost me my favorite domain name, which is still parked). There were no major charges in either case. One charge at a business I’ve never been to. Some people get a card and use it. Some immediately sell it after proving it works. That means a clearing house. A food chain. That will get more automated, not less.
  - marcus0x62 3y ago
    Sure, there are some attacker activities that are highly automated. That’s not what we’re talking about here. We’re talking about compromised temporal session tokens, which are frequently harvested by manual action, and in those scenarios, thinking about human timeframes is very useful.