3 ms·

> A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal. Why "usually does n

> A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal. Why "usually does not"? The stolen hard drive, leaked data, etc. can happen at any point in the future....one minute to one year from now. For most of those times, a short session will prevent the attacker from exploiting it. > The vast majority of ways to compromise a session already give you access far beyond that session itself For the local system, yes. But not the for the remote system.

ilyt 3y ago
Stolen hard drive is rarely what you defend from, and arguably might completely not matter if say their short lived session is dead but long-lived password manager one is up. Exploits owning software on machine are far more common than machine itself being stolen. I'd also argue that tying re-login to the sensitive actions is far better way to fight it. Basically have long session for nondestructive actions but short for any potentially harmful ones like changing payment options.
- paulddraper 3y ago
  Stolen hard drive = Stolen laptop/phone/tablet
  - Too 3y ago
    Or decommissioned drives. I’ve seen businesses put used laptops straight up on second hand market, without barely doing basic formatting of the drives, unencrypted. Even less so on private market. Heard from security friends also that there are examples of attacks that succeeded thanks to drives found in trash outside enterprise.
horsawlarway 3y ago
> For the local system, yes. But not the for the remote system. This is fair, although you've picked a specific case where the local system would not likely access the remote system again after compromise (because theft removes access for the normal user) and an expired session might be helpful as security. But the other thing about theft is that it also immediately alerts the user, and having a simple "Sign me out everywhere" button is a more robust solution that causes much less user pain and mostly accomplishes the same result. As for > one minute to one year from now. I'm not arguing for indefinite sessions. I'm arguing against short sessions. Rotate it after 30 days if you want (or 5 days, or 1 day - just don't do it every 15 minutes). It'll catch 99% of the cases you're thinking about solving, and it's literally 3000 times less annoying for your users while being nearly as secure.
- paulddraper 3y ago
  > theft is that it also immediately alerts the user The user may or may not know of theft or leak. And even if they are aware, they may not know remember every remote system they were logged into. > Rotate it after 30 days if you want (or 5 days, or 1 day - just don't do it every 15 minutes). So we've gone from arguing that short sessions doesn't work, to arguing that it works for such a large % of the cases that it could be relaxed.
  - horsawlarway 3y ago
    I don't think my argument has changed a whit - Short sessions cause more pain than they solve. They are a bad security tool for almost all products. Arguing that short sessions are bad is not the same as arguing that rotation never has its place. Rotation can provide some benefits. My argument is that EXCESSIVE rotation (aka: short sessions, the whole freaking conversation) is folly. It's a bad decision usually implemented without thought or understanding (it's on the checklist...), which has a high cost to users, and actively degrades the product. In return for the costs of short sessions, what are you proposing that your users gain? Because personally, logging in every 15 minutes for the rest of my life is a god damn travesty of an exchange to make to cover me on the one case where my laptop goes missing. Especially since that's not a very common vector for account theft. It's SO much more likely someone just calls the help center and claims to be me and gets in just fine.

ilyt 3y ago

Stolen hard drive is rarely what you defend from, and arguably might completely not matter if say their short lived session is dead but long-lived password manager one is up. Exploits owning software on machine are far more common than machine itself being stolen. I'd also argue that tying re-login to the sensitive actions is far better way to fight it. Basically have long session for nondestructive actions but short for any potentially harmful ones like changing payment options.

paulddraper 3y ago
Stolen hard drive = Stolen laptop/phone/tablet
- Too 3y ago
  Or decommissioned drives. I’ve seen businesses put used laptops straight up on second hand market, without barely doing basic formatting of the drives, unencrypted. Even less so on private market. Heard from security friends also that there are examples of attacks that succeeded thanks to drives found in trash outside enterprise.

horsawlarway 3y ago

> For the local system, yes. But not the for the remote system. This is fair, although you've picked a specific case where the local system would not likely access the remote system again after compromise (because theft removes access for the normal user) and an expired session might be helpful as security. But the other thing about theft is that it also immediately alerts the user, and having a simple "Sign me out everywhere" button is a more robust solution that causes much less user pain and mostly accomplishes the same result. As for > one minute to one year from now. I'm not arguing for indefinite sessions. I'm arguing against short sessions. Rotate it after 30 days if you want (or 5 days, or 1 day - just don't do it every 15 minutes). It'll catch 99% of the cases you're thinking about solving, and it's literally 3000 times less annoying for your users while being nearly as secure.

paulddraper 3y ago
> theft is that it also immediately alerts the user The user may or may not know of theft or leak. And even if they are aware, they may not know remember every remote system they were logged into. > Rotate it after 30 days if you want (or 5 days, or 1 day - just don't do it every 15 minutes). So we've gone from arguing that short sessions doesn't work, to arguing that it works for such a large % of the cases that it could be relaxed.
- horsawlarway 3y ago
  I don't think my argument has changed a whit - Short sessions cause more pain than they solve. They are a bad security tool for almost all products. Arguing that short sessions are bad is not the same as arguing that rotation never has its place. Rotation can provide some benefits. My argument is that EXCESSIVE rotation (aka: short sessions, the whole freaking conversation) is folly. It's a bad decision usually implemented without thought or understanding (it's on the checklist...), which has a high cost to users, and actively degrades the product. In return for the costs of short sessions, what are you proposing that your users gain? Because personally, logging in every 15 minutes for the rest of my life is a god damn travesty of an exchange to make to cover me on the one case where my laptop goes missing. Especially since that's not a very common vector for account theft. It's SO much more likely someone just calls the help center and claims to be me and gets in just fine.