8 ms·

The main place I see short session expirations is on banking and financial apps, which seems defensible to me for a couple of reasons: 1) They're used by a wid

The main place I see short session expirations is on banking and financial apps, which seems defensible to me for a couple of reasons: 1) They're used by a wide variety of people, including people who may not own a computer or mobile device, or who may not have a backup device to use when their personal device breaks. This group is probably shrinking—more and more people have smartphones and the remaining people who don't have smartphones are probably also the people without bank accounts—but arguably you want to cater to this group, since they may already be a bigger target for scams. 2) They're very appealing to opportunistic attackers. 3) They're used by people in stressful or unusual circumstances, e.g., when traveling, if they need to make a large emergency payment, or if they're afraid of being scammed. 4) Most sessions aren't very long anyway: checking a balance, seeing whether your paycheck came in, making a single transfer or payment, etc. There are definitely exceptions—15-minute timeouts are very annoying when doing taxes, for example—but it seems like the annoyance in these situations is potentially worth the security benefits. That being said, I don't know if short session expiration is the best solution in 2023. As the article points out, major corporations like Google don't use short sessions, even though their services are used for a variety of sensitive things and they're huge targets. But as briHass pointed out in another comment, they also provide tools to see which sessions are open and use a variety of techniques to detect sessions being misused. I suspect that's the actual best solution if avoiding session stealing is that big of a concern.

kccqzy 3y ago
> major corporations like Google don't use short sessions Ask a Google employee. When I worked there sessions were limited to 20 hours. Beyond that full re-authentication with password + security key would be needed.
- mynameisvlad 3y ago
  I’m pretty sure they mean for consumer accounts, not their own organizational logins.
- sss111 3y ago
  Why'd you leave?
  - kccqzy 3y ago
    Dissatisfaction with the speed at which Google does things due to organizational reasons. Lots of smart people working very hard, only to have little to show.
adrr 3y ago
Training people to always login makes the susceptible to phishing attacks with fake logins. It becomes second nature to put in your email and password. Whats even worst is that banks won't send messages over email instead they make you sign into their "Secure" message center. Some how email is insecure but sending the same info in a physical mailing is safer. Any time you select electronic statements instead of physical mailings, they send you an email and force you back to their site to login.
- AnthonyMouse 3y ago
  Not only that, they put the link to the site in the email.
ljm 3y ago
My main bank uses username + password + (random subset of ‘memorable word but actually unencrypted password’ driven by select boxes), then 2FA on top, and it literally feels like they just slapped a bunch of things together to add extra barriers to auth in sequence. This is the UK. Back in Latvia I would just slide my ID card into a USB reader and cryptographically sign the session with a passcode. Same as chip & pin.
- vidarh 3y ago
  I'm Norwegian, but have lived in the UK since 2000, so I've seen the evolution step by step, and UK banks have pretty much just kept adding new steps every time fraud got too bad instead of rethinking things properly. It's infuriating. Norway has a near universal electronic signature solution not quite the same as your Latvian one but sounds similar-ish (and there's a EU/EEA requirement to require mutual recognition at some point) and it feels much better (e.g. the Norwegian ones allow access to government websites as well, and can be used to sign contracts etc. - I'm assuming the Latvian one has similar options).
  - ljm 3y ago
    Yeah your ID in Latvia has an electronic certificate for governments, banks, etc
- williamcotton 3y ago
  I’m so envious of the Baltic’s use of technology at the institutional level. It seems literally infeasible for the United States to have state-issued PKI. It’s a meta-partisan issue: no side trusts the other to manage crypto or computer systems. So for example instead of a public many-to-many digital publishing platform we are stuck with the whims of grown men who want to fist fight each other in the Colosseum and all because every X is convinced every Y is so despicable and corrupt that such a public system would be much worse than what we have now.
  - NavinF 3y ago
    tbh I can't think of many cases where I'd want state-issued PKI. I already use public key crypto secured by biometrics (faceid) to make payments, login to my bank, etc. None of that requires interacting with the state. For most normal computer use I quite like how random social media sites can't demand my identity because it'd be too expensive for them to verify it using public records.
dcow 3y ago
To be honest I feel like biometric app unlock has largely made the need for the short tokens banking experience obsolete. I don’t want to change my credential ever 15 minutes, I just want my bank app to verify my biometrics on sensitive operations. The only real reason for short lived bearer “tokens” these days is so you can deploy them in scenarios without revocation lists.
- rkeene2 3y ago
  This is how the banking app my team built works -- on Android/iOS devices a hardware-backed keypair is generated and when a login is needed, the keychain is unlocked using local biometrics to perform a signing operation which authenticates the user. There's a bit more to it than that because we support remote attestation, and you only get a read-only token until you've performed remote attestation (which generally happens quickly). edit: The authentication results in a short-lived token (5m), a refresh token (20m), but can be re-authenticated with the keypair challenge at any time.
npunt 3y ago
Health services also log you out after ~15min. Kaiser, One Medical, Epic Mychart, etc. Very annoying
- deleted 3y ago
  [deleted]
- actuallyalys 3y ago
  I think reasons 1 and 3 I listed for financial apps and websites apply for health services, but 2 and 4 don't, so I see why they do it, even if it's less clear-cut.
- xp84 3y ago
  Some of my highest-paranoia sites and apps are things like my dental insurance. Yeah guys, hackers are out to get me and they can't wait to impersonate me and reschedule my next cleaning for an inconvenient time!
- cjcampbell 3y ago
  In my experience, a large percentage of compliance officers believe that this is a non-negotiable requirement for HIPAA compliant web apps. My reading of the Security Rule is much more pragmatic, so I would argue that there are other ways to meet this standard in many situations.
Fatnino 3y ago
There is a class of people who feel a smartphone is too much of a distraction to carry around all the time. They will carry around a flip phone that can do basically nothing beyond calls, sms, and camera. These are otherwise perfectly normal members of society with bank accounts. I don't know how common these people are. I happen to know a handful of them but I probably don't travel in typical circles.
- jperras 3y ago
  I live in a very Hasidic Jewish neighbourhood in North America; they (almost) uniquely use flip phones instead of smart phones. I've even seen women with cordless landline phones mounted to their shpitzel so that they can use it "hands-free", but without breaking their rules around kosher technology. Some context: https://www.theguardian.com/world/2022/jul/19/kosher-phone-dispute-grips-ultra-orthodox-tel-aviv-suburb https://www.theguardian.com/world/2022/jul/19/kosher-phone-d...
- actuallyalys 3y ago
  In case it wasn't clear, I didn't meant to disparage people without phones or computers (or for that matter, people without bank accounts), just to note they are a small group of people and shrinking.
  - Fatnino 3y ago
    The people I brought up used to have smartphones and made a conscious decision to go back down the tech tree. So an inflow to the no smartphone group. Certainly not outweighed by the outflow so the group is still shrinking as you state.
wredue 3y ago
I see pretty short timers in enterprise saas as well. Reason being that having a license for 400 users is much more expensive than a license for 30 users.
- linuxdude314 3y ago
  Pretty much all SaaS products charge per unique user, not active sessions, so I don’t really understand what point you’re trying to convey.
  - wredue 3y ago
    Nearly all of our agreements are in active sessions. I guess your business just needs better negotiation?
fsckboy 3y ago
> I suspect that's the actual best solution if avoiding session stealing is that big of a concern that big of a concern for whom? Google doesn't care because Google has constructed a world where when something goes wrong, sorry, it's on you. Your bank does care because if something goes wrong, it's frequently on them. The bank times you out to protect them more than you.
calderwoodra 3y ago
I'll add one more: Fintech app users constantly ask for short sessions. As the developer, I really didn't want to add it, but who cares what I want.
megous 3y ago
Smartphone sounds like the worst device you can use for banking. If remotely compromised, the attecker gets everything they need. The SMS second factor, the user's password, access to user's network, and the user's behavior profile to know when to execute the attack so that they get as much time for it as possible.
- caskstrength 3y ago
  On the other hand I would assume that modern smartphones from manufacturers that care about security to some degree are much harder to compromise compared to random Windows laptops.
  - zigzag312 3y ago
    Pixel phones had exploit discovered last year where you could unlock any phone by entering the PUK code. You just replaced the SIM card with your own SIM for which you knew the PUK. Seems very easy to me. https://9to5google.com/2022/11/10/pixel-lockscreen-unlock-bug/ https://9to5google.com/2022/11/10/pixel-lockscreen-unlock-bu...
josefx 3y ago
> but it seems like the annoyance in these situations is potentially worth the security benefits. I would be happy if there was a way to just request a long session for that. No need to force everything into a short session just because it is a sensible default.

kccqzy 3y ago

> major corporations like Google don't use short sessions Ask a Google employee. When I worked there sessions were limited to 20 hours. Beyond that full re-authentication with password + security key would be needed.

mynameisvlad 3y ago
I’m pretty sure they mean for consumer accounts, not their own organizational logins.
sss111 3y ago
Why'd you leave?
- kccqzy 3y ago
  Dissatisfaction with the speed at which Google does things due to organizational reasons. Lots of smart people working very hard, only to have little to show.

adrr 3y ago

Training people to always login makes the susceptible to phishing attacks with fake logins. It becomes second nature to put in your email and password. Whats even worst is that banks won't send messages over email instead they make you sign into their "Secure" message center. Some how email is insecure but sending the same info in a physical mailing is safer. Any time you select electronic statements instead of physical mailings, they send you an email and force you back to their site to login.

AnthonyMouse 3y ago
Not only that, they put the link to the site in the email.

ljm 3y ago

My main bank uses username + password + (random subset of ‘memorable word but actually unencrypted password’ driven by select boxes), then 2FA on top, and it literally feels like they just slapped a bunch of things together to add extra barriers to auth in sequence. This is the UK. Back in Latvia I would just slide my ID card into a USB reader and cryptographically sign the session with a passcode. Same as chip & pin.

vidarh 3y ago
I'm Norwegian, but have lived in the UK since 2000, so I've seen the evolution step by step, and UK banks have pretty much just kept adding new steps every time fraud got too bad instead of rethinking things properly. It's infuriating. Norway has a near universal electronic signature solution not quite the same as your Latvian one but sounds similar-ish (and there's a EU/EEA requirement to require mutual recognition at some point) and it feels much better (e.g. the Norwegian ones allow access to government websites as well, and can be used to sign contracts etc. - I'm assuming the Latvian one has similar options).
- ljm 3y ago
  Yeah your ID in Latvia has an electronic certificate for governments, banks, etc
williamcotton 3y ago
I’m so envious of the Baltic’s use of technology at the institutional level. It seems literally infeasible for the United States to have state-issued PKI. It’s a meta-partisan issue: no side trusts the other to manage crypto or computer systems. So for example instead of a public many-to-many digital publishing platform we are stuck with the whims of grown men who want to fist fight each other in the Colosseum and all because every X is convinced every Y is so despicable and corrupt that such a public system would be much worse than what we have now.
- NavinF 3y ago
  tbh I can't think of many cases where I'd want state-issued PKI. I already use public key crypto secured by biometrics (faceid) to make payments, login to my bank, etc. None of that requires interacting with the state. For most normal computer use I quite like how random social media sites can't demand my identity because it'd be too expensive for them to verify it using public records.

dcow 3y ago

To be honest I feel like biometric app unlock has largely made the need for the short tokens banking experience obsolete. I don’t want to change my credential ever 15 minutes, I just want my bank app to verify my biometrics on sensitive operations. The only real reason for short lived bearer “tokens” these days is so you can deploy them in scenarios without revocation lists.

rkeene2 3y ago
This is how the banking app my team built works -- on Android/iOS devices a hardware-backed keypair is generated and when a login is needed, the keychain is unlocked using local biometrics to perform a signing operation which authenticates the user. There's a bit more to it than that because we support remote attestation, and you only get a read-only token until you've performed remote attestation (which generally happens quickly). edit: The authentication results in a short-lived token (5m), a refresh token (20m), but can be re-authenticated with the keypair challenge at any time.

npunt 3y ago

Health services also log you out after ~15min. Kaiser, One Medical, Epic Mychart, etc. Very annoying

deleted 3y ago
[deleted]
actuallyalys 3y ago
I think reasons 1 and 3 I listed for financial apps and websites apply for health services, but 2 and 4 don't, so I see why they do it, even if it's less clear-cut.
xp84 3y ago
Some of my highest-paranoia sites and apps are things like my dental insurance. Yeah guys, hackers are out to get me and they can't wait to impersonate me and reschedule my next cleaning for an inconvenient time!
cjcampbell 3y ago
In my experience, a large percentage of compliance officers believe that this is a non-negotiable requirement for HIPAA compliant web apps. My reading of the Security Rule is much more pragmatic, so I would argue that there are other ways to meet this standard in many situations.

Fatnino 3y ago

There is a class of people who feel a smartphone is too much of a distraction to carry around all the time. They will carry around a flip phone that can do basically nothing beyond calls, sms, and camera. These are otherwise perfectly normal members of society with bank accounts. I don't know how common these people are. I happen to know a handful of them but I probably don't travel in typical circles.

jperras 3y ago
I live in a very Hasidic Jewish neighbourhood in North America; they (almost) uniquely use flip phones instead of smart phones. I've even seen women with cordless landline phones mounted to their shpitzel so that they can use it "hands-free", but without breaking their rules around kosher technology. Some context: https://www.theguardian.com/world/2022/jul/19/kosher-phone-dispute-grips-ultra-orthodox-tel-aviv-suburb https://www.theguardian.com/world/2022/jul/19/kosher-phone-d...
actuallyalys 3y ago
In case it wasn't clear, I didn't meant to disparage people without phones or computers (or for that matter, people without bank accounts), just to note they are a small group of people and shrinking.
- Fatnino 3y ago
  The people I brought up used to have smartphones and made a conscious decision to go back down the tech tree. So an inflow to the no smartphone group. Certainly not outweighed by the outflow so the group is still shrinking as you state.

wredue 3y ago

I see pretty short timers in enterprise saas as well. Reason being that having a license for 400 users is much more expensive than a license for 30 users.

linuxdude314 3y ago
Pretty much all SaaS products charge per unique user, not active sessions, so I don’t really understand what point you’re trying to convey.
- wredue 3y ago
  Nearly all of our agreements are in active sessions. I guess your business just needs better negotiation?

fsckboy 3y ago

> I suspect that's the actual best solution if avoiding session stealing is that big of a concern that big of a concern for whom? Google doesn't care because Google has constructed a world where when something goes wrong, sorry, it's on you. Your bank does care because if something goes wrong, it's frequently on them. The bank times you out to protect them more than you.

calderwoodra 3y ago

I'll add one more: Fintech app users constantly ask for short sessions. As the developer, I really didn't want to add it, but who cares what I want.

megous 3y ago

Smartphone sounds like the worst device you can use for banking. If remotely compromised, the attecker gets everything they need. The SMS second factor, the user's password, access to user's network, and the user's behavior profile to know when to execute the attack so that they get as much time for it as possible.

caskstrength 3y ago
On the other hand I would assume that modern smartphones from manufacturers that care about security to some degree are much harder to compromise compared to random Windows laptops.
- zigzag312 3y ago
  Pixel phones had exploit discovered last year where you could unlock any phone by entering the PUK code. You just replaced the SIM card with your own SIM for which you knew the PUK. Seems very easy to me. https://9to5google.com/2022/11/10/pixel-lockscreen-unlock-bug/ https://9to5google.com/2022/11/10/pixel-lockscreen-unlock-bu...

josefx 3y ago

> but it seems like the annoyance in these situations is potentially worth the security benefits. I would be happy if there was a way to just request a long session for that. No need to force everything into a short session just because it is a sensible default.