3 ms·

> For the local system, yes. But not the for the remote system. This is fair, although you've picked a specific case where the local system would not likely ac

> For the local system, yes. But not the for the remote system. This is fair, although you've picked a specific case where the local system would not likely access the remote system again after compromise (because theft removes access for the normal user) and an expired session might be helpful as security. But the other thing about theft is that it also immediately alerts the user, and having a simple "Sign me out everywhere" button is a more robust solution that causes much less user pain and mostly accomplishes the same result. As for > one minute to one year from now. I'm not arguing for indefinite sessions. I'm arguing against short sessions. Rotate it after 30 days if you want (or 5 days, or 1 day - just don't do it every 15 minutes). It'll catch 99% of the cases you're thinking about solving, and it's literally 3000 times less annoying for your users while being nearly as secure.

paulddraper 3y ago
> theft is that it also immediately alerts the user The user may or may not know of theft or leak. And even if they are aware, they may not know remember every remote system they were logged into. > Rotate it after 30 days if you want (or 5 days, or 1 day - just don't do it every 15 minutes). So we've gone from arguing that short sessions doesn't work, to arguing that it works for such a large % of the cases that it could be relaxed.
- horsawlarway 3y ago
  I don't think my argument has changed a whit - Short sessions cause more pain than they solve. They are a bad security tool for almost all products. Arguing that short sessions are bad is not the same as arguing that rotation never has its place. Rotation can provide some benefits. My argument is that EXCESSIVE rotation (aka: short sessions, the whole freaking conversation) is folly. It's a bad decision usually implemented without thought or understanding (it's on the checklist...), which has a high cost to users, and actively degrades the product. In return for the costs of short sessions, what are you proposing that your users gain? Because personally, logging in every 15 minutes for the rest of my life is a god damn travesty of an exchange to make to cover me on the one case where my laptop goes missing. Especially since that's not a very common vector for account theft. It's SO much more likely someone just calls the help center and claims to be me and gets in just fine.

paulddraper 3y ago

> theft is that it also immediately alerts the user The user may or may not know of theft or leak. And even if they are aware, they may not know remember every remote system they were logged into. > Rotate it after 30 days if you want (or 5 days, or 1 day - just don't do it every 15 minutes). So we've gone from arguing that short sessions doesn't work, to arguing that it works for such a large % of the cases that it could be relaxed.

horsawlarway 3y ago
I don't think my argument has changed a whit - Short sessions cause more pain than they solve. They are a bad security tool for almost all products. Arguing that short sessions are bad is not the same as arguing that rotation never has its place. Rotation can provide some benefits. My argument is that EXCESSIVE rotation (aka: short sessions, the whole freaking conversation) is folly. It's a bad decision usually implemented without thought or understanding (it's on the checklist...), which has a high cost to users, and actively degrades the product. In return for the costs of short sessions, what are you proposing that your users gain? Because personally, logging in every 15 minutes for the rest of my life is a god damn travesty of an exchange to make to cover me on the one case where my laptop goes missing. Especially since that's not a very common vector for account theft. It's SO much more likely someone just calls the help center and claims to be me and gets in just fine.