8 ms·
Seems bad that the cookies are still valid after password rotation. Relatedly, is this another instance of HN serving as de-facto Google tech support/customer
by tyoma 3y ago
Seems bad that the cookies are still valid after password rotation.
Relatedly, is this another instance of HN serving as de-facto Google tech support/customer service?
- wannacboatmovie 3y agoYou act as if it's a bug, not an intentional feature - so Google can continue to track you in perpetuity.
- kevin_nisbet 3y agoI doubt google needs to use this as a feature for tracking. Even if we argued that this was for tracking purposes, google could keep the cookie for tracking and just deny access to the services until a login flow was completed.
- ksjskskskkk 3y agologing in serves as giving them authorization to track you under jurisdiction where they cannot just track you by any means available
- tekla 3y agoGive evidence.
- throwaway892238 3y agoIt's not just bad, it's a fundamental failure of security. The effect is the same as a password that can't be changed. It might still be possible for users to manually delete active sessions in some Google account management page, but nobody in the world would expect they'd need to do that after changing their password.
- kevin_nisbet 3y agoYea, I equate it to part of security theater. I worked on a product that rotated the TLS certificate frequently. And it actually showed up a number of times in questions from customers or vendor security questionnaires about whether we rotated the certificates and how that happened. But what we were never asked was whether old certificates were cancelled... which in that system they were not. So it didn't matter how many times we rotated our secrets, any old or leaked secret in a backup or elsewhere was still completely valid. But we had met the security theater that those rotations happened. So I expect what you do, is that changing a password would cancel all sessions using that credential. But that's kind of hard to do, so we'll just leave that side buggy and untested, because we did the important part of the theater that said we can change passwords.
- groestl 3y ago> So it didn't matter how many times we rotated our secrets I'm confused, did you rotate your certs or your secrets?
- charcircuit 3y agoThe private key of a cert is a secret that is not reused between certs.
- groestl 3y agoSays who?
- comprambler 3y agoThe private key is definitely reused between certs unless you go through a process of rekeying which requires a new CSR.
- charcircuit 3y agoIt's technically possible to reuse it, but letsencrypt / certbot do not reuse it by default. You have to go out of your way and do extra work to reuse a CSR when renewing a cert.
- hsbauauvhabzb 3y agoWhy? Im all for terminating sessions if the user wants it, but there are valid reasons to change passwords without knowledge of a breach. Fwiw, terminating old sessions can be pretty hard in SSO systems and similar, though.
- skybrian 3y agoIt's bad because when someone suspects unauthorized access to their account, the first thing anyone recommends is to change your password. If the old cookies keep working, changing your password doesn't help.
- hsbauauvhabzb 3y agoI agree - but it should be an option, rather than permanent.
- Zamicol 3y agoSo that's how they address the state issue. They just ignore the problem! I always wondered how they addressed the state problem of cookie bearer tokens.
- uxp8u61q 3y agoThe easy and widespread solution to this issue is simply to ask the user if they would like to log out their other devices when they change their password.
- newZWhoDis 3y agoLTT found out the hard way, their attacker had a session token for an employee and changing everyone’s passwords didn’t lock the attacker out.
- Adverblessly 3y agoI've hacked into your account and changed your password. Should all your cookies mean nothing for when you try to regain access to your account? Similarly, should knowledge if your old password contribute nothing towards allowing you back into your account? Which is more trustworthy, the same device/cookie I've seen logged into the account for the last <duration of retention period>, or some new one that just reset the password? I won't pretend to understand Google's mechanisms or intentions, nor the workings of this exploit, but surely it is more complicated then simply invalidating all prior info upon password rotation?
- LelouBil 3y agoDiscord does this, if you change your password it invalidates your Authentication JWT
- anticensor 3y agoDiscord user tokens are not JWT: https://user-images.githubusercontent.com/34555296/120932740-4ca47480-c6f7-11eb-9270-6fb3fbbd856c.png https://user-images.githubusercontent.com/34555296/120932740... Unless your Discord server is actually a spacebar server, in which case they are JWT: https://github.com/spacebarchat/server/blob/master/src/util/util/Token.ts https://github.com/spacebarchat/server/blob/master/src/util/...
- LelouBil 3y agoOh, I didn't look closely and thought it matched (because of the dots) but yeah it doesn't start with "ey". Thanks for the information, it's good to know that the token contains the user id inside of it.