4 ms·

I wish more websites would grant you the option to say "I never want my session to expire until I log out, I understand the risks". The "remember me" button doe

I wish more websites would grant you the option to say "I never want my session to expire until I log out, I understand the risks". The "remember me" button does nothing these days. I'm so tired of having my day constantly interrupted by expiring sessions. GitHub is my least favourite; I use it ~weekly, so my sessions always expire, and they forced me to use 2FA so I have to drag my phone out and punch in random numbers. Every single time. As well as being terrible UX, though I have no evidence to back this up, I'm pretty sure this constant logging in fatigues users enough to where they stop paying attention. If you log into a site multiple times a week, it's easy for a phishing site to slip into your 60th login. Conversely if you've got an account that you never need to log into, it's going to feel really weird and heighten your awareness if it suddenly does ask for a password. Regardless, companies should learn that everyone has a different risk appetite and security posture, and provide options. Side-note, Github's constant session expiry & 2FA annoyed me so much that I moved to Gitea and disabled expiry. That was 90% of the reason I moved. It's only available on my network too, so if anything I feel I gained on security. Companies 100% can lose customers by having an inflexible security model.

lovethevoid 2y ago
Are you sure you haven't toggled something in your browser settings? There are a plethora of settings that would wind up rendering those "remember me" buttons useless. Anecdotally, I haven't had any issues with staying logged into websites. Github being one of them.
- RadiozRadioz 2y ago
  Yes I am definitely confident with how my browser is configured. Our usage patterns/tolerances must simply be different. Part of the issue is I use it weekly from 3 different devices, so there's always one device that needs another login. I know it's not my browser, as on my own web apps I set the maxAge of my session cookies to 10 years and they work perfectly.
Tubelord 2y ago
This resource has a good recommendation on how session lifetimes should work. Roughly, that it should continue for 30 days if used within 30 days. https://thecopenhagenbook.com/sessions#session-lifetime https://thecopenhagenbook.com/sessions#session-lifetime
lolinder 2y ago
Notion is the worst offender for me, not because of its frequency but because it will actually interrupt an active session and forces you to log back in. Worse, the session seems to last just a minute or two longer than one week, which means it will boot you this week just a little bit after you started your work last week. A few weeks back I logged in right before a recurring meeting to take notes, and for several weeks running it's been interrupting me in the middle of that meeting to force me to log in again.
- mcoliver 2y ago
  Logout on a Saturday and reset the cycle
  - lolinder 2y ago
    If I'm right about the timings that would only work for a week unless I intentionally log out and in every Saturday. Otherwise it'll always log me out soon after the time that I first needed Notion the week before.
Tade0 2y ago
Some authentication providers cap token lifetime depending on pricing plan.
bongodongobob 2y ago
[flagged]
- RadiozRadioz 2y ago
  Random users might not, but this is HN. You're getting down voted for your condescending tone about an issue that, for most technical people here, has extremely obvious risks. Instead of implying that others are ignorant in a low-value comment, list out why you think this is a bad idea.
  - bongodongobob 2y ago
    Nah, it's a stupid opinion to think you should just cache creds forever and doesn't deserve more than I've given. On a fuckin tech site of this caliber. This isn't a Facebook group and it's frankly frightening that I'd have to here, of all places.
    - jampekka 2y ago
      It's not a stupid opinion to have different productivity/risk tradeoffs. A lot of "all admins" don't seem to care much about productivity, yank and unintended consequences. "All admins" pushed the ridiculous password rules and renewals for decades with similar confidence that they now push the progressively more byzantine MFA schemes.
  - khafra 2y ago
    Seems like an "I understand the risks, keep me signed in" button would affect more than just HN users. Unless you have to prove you know the risks by logging into a HN profile with at least 1000 karma, or taking a short quiz on authentication best practices, or something.
  - baq 2y ago
    He’s right, though. I understand the risk of this session never expiring is the same as No sane person should ever request a token which never expires. Your fat tail of risk dominates the whole distribution of outcomes.
turboponyy 2y ago
Um, my session with GitHub never expires - weird.
- GoblinSlayer 2y ago
  I suppose it's _gh_sess cookie which expires at end of session. The cookie lives as long as the browser is open.
- throwaway42939 2y ago
  Maybe it automatically extends it when you are using it? This is at least what we do for our web application, where users are automatically refreshed indefinitely unless they are inactive for more than a few days (enough to cover Saturday/Sunday when they are not working). We have an access token that is refreshed in 5 minute intervals. The refresh request also provides a new refresh token with an extended expiration. A deactivated user can use it for a maximum of a few minutes until the access token expires, because the refresh request will fail. It's fine for our use case, but it may not be for everyone. We could potentially include a token black-list in the backend for emergency uses, but we haven't seen the need for it yet.
GoblinSlayer 2y ago
At least you can enjoy security theater.

lovethevoid 2y ago

Are you sure you haven't toggled something in your browser settings? There are a plethora of settings that would wind up rendering those "remember me" buttons useless. Anecdotally, I haven't had any issues with staying logged into websites. Github being one of them.

RadiozRadioz 2y ago
Yes I am definitely confident with how my browser is configured. Our usage patterns/tolerances must simply be different. Part of the issue is I use it weekly from 3 different devices, so there's always one device that needs another login. I know it's not my browser, as on my own web apps I set the maxAge of my session cookies to 10 years and they work perfectly.

Tubelord 2y ago

This resource has a good recommendation on how session lifetimes should work. Roughly, that it should continue for 30 days if used within 30 days. https://thecopenhagenbook.com/sessions#session-lifetime https://thecopenhagenbook.com/sessions#session-lifetime

lolinder 2y ago

Notion is the worst offender for me, not because of its frequency but because it will actually interrupt an active session and forces you to log back in. Worse, the session seems to last just a minute or two longer than one week, which means it will boot you this week just a little bit after you started your work last week. A few weeks back I logged in right before a recurring meeting to take notes, and for several weeks running it's been interrupting me in the middle of that meeting to force me to log in again.

mcoliver 2y ago
Logout on a Saturday and reset the cycle
- lolinder 2y ago
  If I'm right about the timings that would only work for a week unless I intentionally log out and in every Saturday. Otherwise it'll always log me out soon after the time that I first needed Notion the week before.

Tade0 2y ago

Some authentication providers cap token lifetime depending on pricing plan.

bongodongobob 2y ago

[flagged]

RadiozRadioz 2y ago
Random users might not, but this is HN. You're getting down voted for your condescending tone about an issue that, for most technical people here, has extremely obvious risks. Instead of implying that others are ignorant in a low-value comment, list out why you think this is a bad idea.
- bongodongobob 2y ago
  Nah, it's a stupid opinion to think you should just cache creds forever and doesn't deserve more than I've given. On a fuckin tech site of this caliber. This isn't a Facebook group and it's frankly frightening that I'd have to here, of all places.
  - jampekka 2y ago
    It's not a stupid opinion to have different productivity/risk tradeoffs. A lot of "all admins" don't seem to care much about productivity, yank and unintended consequences. "All admins" pushed the ridiculous password rules and renewals for decades with similar confidence that they now push the progressively more byzantine MFA schemes.
- khafra 2y ago
  Seems like an "I understand the risks, keep me signed in" button would affect more than just HN users. Unless you have to prove you know the risks by logging into a HN profile with at least 1000 karma, or taking a short quiz on authentication best practices, or something.
- baq 2y ago
  He’s right, though. I understand the risk of this session never expiring is the same as No sane person should ever request a token which never expires. Your fat tail of risk dominates the whole distribution of outcomes.

turboponyy 2y ago

Um, my session with GitHub never expires - weird.

GoblinSlayer 2y ago
I suppose it's _gh_sess cookie which expires at end of session. The cookie lives as long as the browser is open.
throwaway42939 2y ago
Maybe it automatically extends it when you are using it? This is at least what we do for our web application, where users are automatically refreshed indefinitely unless they are inactive for more than a few days (enough to cover Saturday/Sunday when they are not working). We have an access token that is refreshed in 5 minute intervals. The refresh request also provides a new refresh token with an extended expiration. A deactivated user can use it for a maximum of a few minutes until the access token expires, because the refresh request will fail. It's fine for our use case, but it may not be for everyone. We could potentially include a token black-list in the backend for emergency uses, but we haven't seen the need for it yet.

GoblinSlayer 2y ago

At least you can enjoy security theater.