3 ms·

This one seems prone to bias. Out of all the people disagreeing in the comments who actually takes a position against self interest? 1) Security is more your

This one seems prone to bias. Out of all the people disagreeing in the comments who actually takes a position against self interest? 1) Security is more your focus than UX, but you agree with the article. 2) UX is more your focus than security, but you disagree with the article.

thayne 3y ago
Security is more my focus than UX (although I am not myself a "security professional"), and I neither agree nor disagree with the thesis of the article. I think the right answer is the classic "it depends". Specifically, it depends on how bad it would be if a session token is leaked, how the rest of the authentication system works (can session tokens be revoked, what is required to refresh a token, how long is the absolute expiration of a token, etc.), and even whether the user is using a public computer or not. That said, the arguments in this article makes many dangerous assumptions. Such as assuming that users never use a shared computer (like say the computer in a library), and that you can completely reliably avoid tokens from ever accidentally getting logged.
GoblinSlayer 3y ago
Short timeout is neither security nor UX, it's security theater to cover the owner's ass when something happens.
nottorp 3y ago
What's security and what's security theater? Is XSS a fact of life that needs to be protected against or a fundamental flaw of the protocols we currently use that could be fixed at the root if it didn't make web development more expensive/inconvenient?
BeefWellington 3y ago
The mistake is in thinking security is a separate domain from UX. While expertise in it may be, it applies everywhere. To draw a comparison here, should we assume that the author advocates for phones or desktops which do not automatically lock after a set period? It's a similar threat vector (unattended phone/pc) in the physical world. I'd assume no, because the specifics of that threat model are different. This is true of other software as well. UX and security are only at odds in the grey areas. I'd wager most people posting here -- regardless of affiliation -- would be upset if their web banking solution didn't expire their sessions for days.
- WhitneyLand 3y ago
  Agree they’re not at odds. I’m not trying to say they’re adversarial at all. Rather, it’s that I suspect some comparisons are less likely to get objective thinking out of us than others.

thayne 3y ago

Security is more my focus than UX (although I am not myself a "security professional"), and I neither agree nor disagree with the thesis of the article. I think the right answer is the classic "it depends". Specifically, it depends on how bad it would be if a session token is leaked, how the rest of the authentication system works (can session tokens be revoked, what is required to refresh a token, how long is the absolute expiration of a token, etc.), and even whether the user is using a public computer or not. That said, the arguments in this article makes many dangerous assumptions. Such as assuming that users never use a shared computer (like say the computer in a library), and that you can completely reliably avoid tokens from ever accidentally getting logged.

GoblinSlayer 3y ago

Short timeout is neither security nor UX, it's security theater to cover the owner's ass when something happens.

nottorp 3y ago

What's security and what's security theater? Is XSS a fact of life that needs to be protected against or a fundamental flaw of the protocols we currently use that could be fixed at the root if it didn't make web development more expensive/inconvenient?

BeefWellington 3y ago

The mistake is in thinking security is a separate domain from UX. While expertise in it may be, it applies everywhere. To draw a comparison here, should we assume that the author advocates for phones or desktops which do not automatically lock after a set period? It's a similar threat vector (unattended phone/pc) in the physical world. I'd assume no, because the specifics of that threat model are different. This is true of other software as well. UX and security are only at odds in the grey areas. I'd wager most people posting here -- regardless of affiliation -- would be upset if their web banking solution didn't expire their sessions for days.

WhitneyLand 3y ago
Agree they’re not at odds. I’m not trying to say they’re adversarial at all. Rather, it’s that I suspect some comparisons are less likely to get objective thinking out of us than others.