4 ms·
Random users might not, but this is HN. You're getting down voted for your condescending tone about an issue that, for most technical people here, has extremely
by RadiozRadioz 2y ago
Random users might not, but this is HN. You're getting down voted for your condescending tone about an issue that, for most technical people here, has extremely obvious risks.
Instead of implying that others are ignorant in a low-value comment, list out why you think this is a bad idea.
- bongodongobob 2y agoNah, it's a stupid opinion to think you should just cache creds forever and doesn't deserve more than I've given. On a fuckin tech site of this caliber. This isn't a Facebook group and it's frankly frightening that I'd have to here, of all places.
- jampekka 2y agoIt's not a stupid opinion to have different productivity/risk tradeoffs. A lot of "all admins" don't seem to care much about productivity, yank and unintended consequences. "All admins" pushed the ridiculous password rules and renewals for decades with similar confidence that they now push the progressively more byzantine MFA schemes.
- khafra 2y agoSeems like an "I understand the risks, keep me signed in" button would affect more than just HN users. Unless you have to prove you know the risks by logging into a HN profile with at least 1000 karma, or taking a short quiz on authentication best practices, or something.
- baq 2y agoHe’s right, though. I understand the risk of this session never expiring is the same as No sane person should ever request a token which never expires. Your fat tail of risk dominates the whole distribution of outcomes.