17 ms·

Frequent reauth doesn't make you more secure

• willis936 1y ago
  I litigated the "sign back into SSO and every downstream login every four hours" with my IT team. They held their ground. So much money is being lit on fire with the time wasted.
• hacker_homie 1y ago
  But it is easier to implement and maintain so it will continue to be the default.
• deleted 1y ago
  [deleted]
• lapcat 1y ago
  OMG I wish that someone would tell this to Apple. Apple's developer services, such as App Store Connect, actually use session cookies. It's infuriating.
  • andrewmcwatters 1y ago
    Uh, session cookies being one of the most fundamental pieces of authentication tech, there's nothing wrong with them. This is like saying, "example.com actually uses HTTPS. It's infuriating." Do you mean that you have to reauth across domains? Those still use session cookies. Edit: I'm dating myself here, but as far as I can tell apparently sometime between 2010 and 2011, developers started referring to session cookies as cookies with the lifetime of a browser session and not to cookies which contain session data. If anyone can correct me on that timeline, I'd appreciate it. Sorry for the confusion in my comment.
    • paxys 1y ago
      No, sites use persistent cookies, which remain on your browser after you have closed the tab. Session cookies are wiped out automatically after every session.
      • koakuma-chan 1y ago
        I set my browser to clear cookies on exit so that my cookies cannot be stolen by malware.
        • dylan604 1y ago
          how often are you exiting though?
          • koakuma-chan 1y ago
            Every day
        • paxys 1y ago
          Why do you think malware can't steal your cookies when the browser is open (and I assume it is open for most of the day)?
          • koakuma-chan 1y ago
            Because (at least less sophisticated) malware just steals your browser files which contain cookies. I am assuming of course the browser is smart enough not to write cookies to disk if I set it to clear cookies on exit.
      • ffsm8 1y ago
        I think some developers will interpret the term "session cookie" differently then that, because a "session" is usually just something that's tracked in a backend, and an identifier for this session is often written in a cookie Hence... Session cookie, even if set without expiration date
      • thaumasiotes 1y ago
        Session cookies are cookies that identify a session. They last however long you specify. A bank forces quick session expiry. Amazon doesn't. Compare https://docs.djangoproject.com/en/5.2/topics/http/sessions/ https://docs.djangoproject.com/en/5.2/topics/http/sessions/ . > To use cookies-based sessions, set the SESSION_ENGINE setting to "django.contrib.sessions.backends.signed_cookies". > When using the cookies backend the session data can be read by the client. > A MAC (Message Authentication Code) is used to protect the data against changes by the client, so that the session data will be invalidated when being tampered with. The same invalidation happens if the client storing the cookie (e.g. your user’s browser) can’t store all of the session cookie and drops data.
    • voxic11 1y ago
      > Session cookies are temporary data files stored on a user's device to maintain a user's session on a website or application. They are automatically deleted when the user closes their browser or exits the application, unlike persistent cookies which can store information across sessions. Most sites do not use session cookies for auth, they use persistent cookies.
    • deleted 1y ago
      [deleted]
  • cosmic_cheese 1y ago
    Google’s the one I have the most trouble with in this regard. The more things you sign into the worse it gets, seemingly, which really sucks if for example you’ve got a bunch of Android test devices and simulators sharing test accounts. A high profile example is how on the WAN Show, Linus or Luke always get booted out of the show Google Doc and have to sign back in at some point during.
    • gsa 1y ago
      Google is pretty frustrating. I switch between my desktop and laptop frequently and sometimes browsers as well. The reauth dialog pops up two weeks for every login - usually just when I'm about to hop on a meeting.
• clvx 1y ago
  This reads like paraphrasing of SPIFFE. I’m down for it but I wonder of compromised devices that can figure it out how to keep the auth alive (or replicating user behavior). In those cases expiration still sounds like a good idea.
• d4mi3n 1y ago
  Frequent reauth doesn't meaningfully improve your security posture (unless you have a very, very long expiry), but any auth system worth it's salt should have the capability to revoke a session, either via expiry or by user/device. In practice, I find that the latency between when you want to revoke a session to when that session no longer has access to anything is more important than how often you force reauthentication. This gets particularly thorny depending on your auth scheme and how many moving parts you have in your architecture.
  • the8472 1y ago
    You don't need reauthenticate for that, you just need to renew existing tokens. Separate the timeouts for authentication and authorization.
  • antihero 1y ago
    This is why you have refresh tokens - your actual token expires regularly, but the client has a token that allows you to get a new one. Revoking is a case of not allowing them to get a new one.
    • kevin_thibedeau 1y ago
      That's a great way to interfere with local work when the network goes down.
      • rafaelmn 1y ago
        Access tokens are used for network calls so if the network is down nothing works anyway ?
        • dylan604 1y ago
          You mean the power going out is related to why my computer will not respond and the screen went blank? That's strange
          • 1y ago
• timewizard 1y ago
  > What are we really checking? That the security policy for the user and the resulting access key hasn't changed their level of access? Identity, while the most common use case, is only half the system when federating logins.
  • creamstout83 1y ago
    Validated the user that logged in is still the same person.
  • paxys 1y ago
    Why would you need to reauth for that?
• msgodel 1y ago
  Please just talk to my ssh agent and stop harassing me with authentication modals asking for tokens and fingerprints.
• throwforfeds 1y ago
  A client of mine has a 30 min timeout on basically all their systems. I hate using Jira as it is, but having to login pretty much every time I need to go look at my tickets just makes it awful. And then I end up on Hacker News instead of doing actual work.
  • nkrisc 1y ago
    Few things worse than spending 30 minutes writing something only to be asked to login when you submit it. Fortunately these days most services will cache your work.
    • zelphirkalt 1y ago
      Though to rely on Jira to respect your work or your browser functionality is madness.
• xyzzy123 1y ago
  This depends on your "world model", that is, what situations do you anticipate the people using your web site / application are in? The assumption that basically, device = same person (browser session really) over a long period of time is the right one, 99% of the time. Sometimes it's appropriate to make much more conservative assumptions. People might be in bad family situations (where not everyone with access to a shared device might be entirely trustworthy) or using a shared computer because they access things from a library, etc. You can't help much (the computer might as well be compromised) but short session timeouts can make sense.
  • kevincox 1y ago
    > People might be in bad family situations (where not everyone with access to a shared device Then they should configure their browser to log them out. Not hope that every site has good settings for their niche scenario.
• paxys 1y ago
  Corporate IT still makes you change your password every N months. Tell them to extend the max session length beyond a day and some VP will have an aneurysm.
  • al_borland 1y ago
    It’s all theater so they can sell the idea that they’re doing everything they can, and if something does happen they can shift blame.
    • Freebytes 1y ago
      In many cases, it may be to fulfill rules associated with PCIDSS requirements, even if the company never sees the credit card. This all originates from consultants, and the consultants are engaged in security theater.
  • jeremyjh 1y ago
    There is very little incentive to actually do information security correctly - because hardly anyone can tell if you have - consequently there are very few people who try. It is all just theater to cover their asses, and they'll admit it under the right circumstances. They don't want to change idiotic policies like this because it means they'd have to admit they've been dogmatically enforcing counter-productive policies for decades.
    • kevincox 1y ago
      Hardly anyone can tell, until everyone can tell, because you have a breach. It's similar to the idea that if you aren't doing restore drills you aren't really taking backups. But people rarely test their auth rules.
      • jeremyjh 1y ago
        You could do everything correctly and still have a breach, so practitioners are quite fatalistic about it. The key is to diffuse decision making responsibility so that its not clear who can be fired.
• FrancoisBosun 1y ago
  Heroku's 25 hours comes to mind... this is so infuriating and annoying.
• valenterry 1y ago
  This is spot on. And it's a general misunderstanding of security in practice. Availability is often missed/ignored (but it is part of security) and attention is an important currency that needs to be treated carefully - or you and up with the mentioned MFA fatigue attacks or people writing down their passwords.
  • jeremyjh 1y ago
    The most secure thing would be to unplug the servers. edit: I'm agreeing with parent. Availability is part of security. If it weren't, you could unplug the server and call it a day.
  • circular_logic 1y ago
    I have tried to point out that poorly implemented or non contructive security controls reduce system availability. As employes are not able to get to the information they need in a timely manner. But it's been a dead end to many an argument. For some the underlying issue is a refusal to accept that product usability and security are not mutually exclusive and a difficult to use system just leeds to grey IT in the org. The most odd reply I have received was pedantics on the definition of security availability, i.e., "Ensuring data and network resources are accessible to authorized users when needed" Beacause it contains the word "authorized" any controls for authorisation can therefore never affect availability as they have to be authorized before we can consitter it an impediment to availability... If anyone has a reply better than that's ridiculous, please help me here
• Spooky23 1y ago
  Only if you make a bunch of assumptions that may not apply. My employer allows BYO and has a default Outlook Web session timeout. Is it ok that my son stopped at my desk at home and saw customer PII that was left open? I enforce these kinds of policies at my company even though I find them personally stupid. I do so because I’m the custodian of my customers property and have a duty to minimize risk of employees or contractors acting poorly.
  • paxys 1y ago
    Is it ok that your son stops at your desk to see PII while the session is still active? And how does reauth even help with this case? Do you expect your session to expire every 15 minutes while you are taking a break? The problem here isn't auth expiry but you not locking your computer when you step away from your desk. Your policies aren't enforcing security, just security theater (and making a lot of employees very annoyed in the process).
    • Spooky23 1y ago
      Who said it wasn’t locked?
  • nijave 1y ago
    >Is it ok that my son stopped at my desk at home and saw customer PII that was left open? In practice/reality, probably. Most employers will disagree. Consider your son could just as easily over hear a phone call, see a piece of paper, etc. If your son was actively malicious, there's all kinds of things from cameras to video splitters to key loggers he could do. If he's not actively malicious, who cares if he sees something If you're in a line of work worried about shoulder suffering, then you should really consider whether BYO is a good idea.
    • zelphirkalt 1y ago
      "Shoulder suffering" a funny one ; )
      • 1y ago
• harshaw 1y ago
  My problem is that there is a reauth FOMA that gets copied with the most trivial of applications. A good example is the Electrify America charging app. It's job is to be available so you can charge. But they log you out frequently - and they want to do second factor with email. Guess what - that doesn't always work. My wife was trying to charge the other day, was logged out, and couldn't get the email verification to go through. So I had her login with my credentials and I answered the email verification and gave her the token over the phone. super annoying. But more importantly- mobile phones already have good security mechanisms. It's like all these shitty apps copied web based auth mechanisms with timeouts when they could do something better (and probably are built on web technologies with cookies instead of using the trusted store on the phone). There are precious few apps out there that tell you ahead of time that reauth is happening (Zoom does this - kudos). But even so - I don't think it's necessary most of the time.
  • MBCook 1y ago
    I don’t need to charge often, but I’m logged out of every single one of my charging apps for that reason. They kick me out constantly. If you want me to auth to make a payment when starting a session, fine. I’ll hate you, but whatever. Nope. Can’t even get into the app. Want to see where their stations are? Too bad. Sign up, sign in, or hit guest mode and prepare to be annoyed. I can stay signed into Amazon with a credit card set up for years at a time. God forbid I ever want to charge a car.
• tonymet 1y ago
  Yahoo published these findings over 20 years ago , that frequent re-auth made customers less secure because it encouraged poor password hygiene like short passwords, writing them down, etc. It's also risky to have the primary password credential transmitted instead of temporary tokens.
  • al_borland 1y ago
    On the side of things, the risk of never needing your password is people tend to forget it. Just the other week I was helping someone setup a TV and they thought they didn’t have an Amazon login, because they never needed to login. This was a Prime member. 1Password defaults to having users reauthenticate every 2 weeks. I do find this a bit annoying, but I find the occasional reminder of my password to be a necessity evil. Even doing it every 2 weeks for years, there are some days I have trouble bringing it to the front of my mind. And that would mean a hidden piece of paper somewhere with the password written down in case it’s forgotten. As I get older I should accept the idea that I should have these emergency systems in place if my mind does go, but it makes me uncomfortable.
    • tonymet 1y ago
      It's a good point on password usability. Signal app periodically prompts you for the encryption PIN to make sure you don't forget it. I think this should be handled out of band of the login process. Similar to "is xxx still your phone number?" -- companies could do periodic password hygiene and freshness checks. Context matters. Companies forget that people are trying to get something important done, and blocking them for other attention is a huge frustration.
      • cesarb 1y ago
        > Signal app periodically prompts you for the encryption PIN to make sure you don't forget it. At least Signal does not block the app until you enter the PIN. WhatsApp forces you to enter it before you can reach your messages, which not only is annoying when you're in a hurry, but also forces you to type the PIN even when you're in a place where it might be seen by someone else. On the other hand, on Signal it's possible to leave the warning forever at the bottom of the screen without acknowledging it and typing the PIN, which kind of defeats its purpose.
• czk 1y ago
  user clicks a phishing link and is asked to login to M365 again, they do it without hesitation because they are used to doing this 5 times a day logging into phishing links would make more people pause if they didnt have to login constantly to get work done
  • zelphirkalt 1y ago
    Especially with Office 365 this is the case, because of their ridiculous amount of scripts from tons of domains. They are very far removed from making a good product.
• princevegeta89 1y ago
  I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this on my spouse's iPhone as well. Almost felt like Apple hasn't changed a bit after all these years. It keeps fucking prompting for password over and over, randomly when installing apps. although the phone is secured with a touch ID. This happens especially when you reset the phone and starting from scratch - it keeps prompting for the Apple password again and again.
  • paxys 1y ago
    And it's even worse if you are accessing Apple services on a non-Apple device. No matter how many times I click "trust device" when logging in to icloud.com it will still make me do the password + one-time code song and dance the next day. Another pointless annoyance - if Face ID fails when making a payment or installing an app (like it frequently does for reasons like sleeping in bed or wearing sunglasses) it won't fall back to PIN but ask you to enter your Apple account password. Why?? And of course when you're on that prompt there's no way to open your password manager without cancelling out of it entirely. Makes for a fun experience at the checkout counter...
    • thyristan 1y ago
      Microsoft crap is similarly broken. After each and every login there is the question whether it should remember me and whether it should ask that question again. It doesn't matter at all what you answewr there, it changes absolutely nothing.
      • count 1y ago
        Disable anti-tracking features and ad blocks, it turns out cookies and temp storage for ad tracking are how IDPs track your choice to trust the device too.
• paxys 1y ago
  Industry-wide IT security is driven by the "nobody got fired for buying IBM" phenomenon. It doesn't matter if things are broken. It matters that you did everything by the book. And the book in this case was written 30 years ago and is woefully inadequate. But try convincing your VP of information security that employees shouldn't have to change their password every 3 months...
  • lxgr 1y ago
    At least for that one, you can now point to NIST recommendations, which finally discourage rotating passwords.
• LordDragonfang 1y ago
  There's supreme irony with Tailscale being the one posting this -- because one of my biggest annoyances with the service is that, afaict, there's no way to set up a device so that it never expires. I just had two devices - one of which was my main server - I was using it with require re-auth out of nowhere and break one of my workflows. If I had not already set up separate remote access to the server, it would have been really annoying.
  • 0xQSL 1y ago
    There's "disable key expiry" per machine in the tailscale admin panel
  • haiku2077 1y ago
    https://tailscale.com/kb/1028/key-expiry#disabling-key-expiry https://tailscale.com/kb/1028/key-expiry#disabling-key-expir...
  • HeavenFox 1y ago
    Yes, and it's especially frustrating for tailscale, since when it signs you out on the server you are often not in a position to re-auth
    • haiku2077 1y ago
      Just disable key expiry for the machine in the admin console
• bgirard 1y ago
  The flip side of this is that I had a Ring doorbell in a home I lived in. Moved out and split up with my ex. Years later I installed a new Ring doorbell and I got a message from her shortly after installing it saying she was getting notifications again from my new Ring camera. Kind of scary now to wonder if there's any loose accounts somewhere that's leaking sensitive information due to never requiring reauth. I think the worse offender is iMessage. It's very easy to not understand that your SMS messages are -sometimes- going over icloud and can be seen on old apple devices you might have given up. I tried to unregister my phone number from iMessage about 5 times and it just doesn't work for me.
• pqdbr 1y ago
  I'm trying to understand why my Rails application constantly logs me out in my iPhone/Chrome. The same web app stays logged in forever in my mac and I access both of them with the same time intervals.
• NoMoreNicksLeft 1y ago
  They've got the google mail here at work set to make me change the password once per month. The 100-character, unguessable, un-shoulder-surfable password that isn't reused anywhere. In addition to the 2fa I have to use with it. And it will now ask for reauth once per week, which just happens to somehow be 2 minutes before the important weekly meeting I'm supposed to attend which kicks me out of calendar for the link to the Google video meeting. But at least it makes me reauth.
• twodave 1y ago
  The people who need to read these articles are the auditors. Until they change their expectations, the many businesses who have to pass audits are still going to be stuck doing a lot of things that are industry-standard but also very stupid. This is the case even for small businesses in certain fields where security audits are valued. We have at least half a dozen measures in place that we know aren't actually helpful but we also know auditors won't budge on right now.
  • dstroot 1y ago
    Came here to say this, upvoted. Both Apple and Microsoft have "corporate IT" settings that can be used to turn off "trust my device", "remember me", etc. Auditors and CISO offices tend to lean in on checklist security - in other words it doesn't matter if it's actually more secure, it only matters that it passes the checklist audit. Many of the settings are user hostile and incentivize users to work around them. Making real security worse of course...
    • Henchman21 1y ago
      I’m not sure how one changes the mind of auditors who are just there for a job and who aren’t actually interested in the field? IME, the only auditors who are knowledgeable are those overseeing the folks with checklists — and they rarely seem to have the time to correct the folks they’re overseeing.
      • nightpool 1y ago
        Stop paying them, I guess, and find a different audit firm that's more knowledgeable. Just like anything else—you get the level of competence you pay for. (Although I guess there's probably a "sweet spot" at which you can pay less AND get better first-level auditors if you're not looking at the biggest firms that are going to charge the most money and also have the most churn)
      • immibis 1y ago
        In a free market, you don't - you start your own company that doesn't waste half of everyone's time on security, and do stuff twice as efficiently, for half the price and outcompete the other one. Then you get outcompeted by a company with no security at all, which is twice as efficient as you until they get hacked.
• 0xQSL 1y ago
  My employer just started doing daily reauth for all microsoft logins (teams, ...). The worst thing is that it's just 24h not start of day, so it may just be five seconds before you want to join a meeting. They haven't found the setting for mobile yet, so I might just stop using desktop teams.
  • eddythompson80 1y ago
    Had that on the WiFi system at a facility I used to work from for a while. When you connect to their WiFi, you go to a guest portal to connect to the internet. The guest portal grants your MAC address 24 hours of access. Meaning one day you get to work at 9, the next day you get in at 8:55, you’ll have 5 minutes more of WiFi before things just stop working and your system takes a minute to realize you need to reauth with the captive portal
    • lxgr 1y ago
      This is why 24 hours is a particularly bad timespan for reauthentication. With e.g. 16 hours, you’d at least get a predictable prompt on each new workday.
      • steadicat 1y ago
        One time I led a project and ran daily standups by screen-sharing our Asana board so the team could review in-progress tasks. Every day, right in the middle of the meeting, Asana logged me out. I’d rush to log back in to finish the review, thus ensuring we’d repeat the cycle exactly 24 hours later. This silly dance lasted the whole project.
        • nofunsir 1y ago
          Ironically, daily standups:project_management::frequent_reauth:security
        • arccy 1y ago
          Didn't you take weekends off?
• thway15269037 1y ago
  I hate how prevalent it has become and it's getting even worse. One company that is buying our product has enforced SSO in theirs installation, making access_token lifetime of 15 seconds and refresh_token 4 minutes. For those unaware of OIDC/OAuth/SSO terminology, basically it means "if you lost access to internet for 4 minutes, invalidate your session, invalidate everything, make user go to auth, pick up 2fa, input everything...". It causes incredible amount of stress in end users, who keep spamming us with tickets how our product logs out them every minute, like when they closed laptop for a minute, went from one building to another or when their VPN simply lost connection while they were on a lunch. It's like hundreds tickets per day when normally it's 3-4 per week. And you can't really do anything about it, because "muh security standards", "we need to pass audit" and whatever. I actually want to sit down and calculate how much working hours of everyone involved are wasted every single day, day after day, it's completely bonkers.
  • MBCook 1y ago
    15 seconds? I’ve never heard of anything like that. The recommendation I’ve always seen is 15 minutes. Seems like you could quickly run afoul of that just from a spotty Internet connection.
• carra 1y ago
  I don't get why asking for a password multiple times is perceived as more secure. It's the same password. If an attacker was able to find it and input it once, surely they can do it multiple times too...
  • stavros 1y ago
    It's not about asking for the password, it's about expiring sessions frequently. Nobody is going to steal sessions, of course, but the cargo cult security remains.
• artursapek 1y ago
  I was working at a crypto exchange for years and completely burned out on reauth. VPN session would die, 20 different SaaS products would log me out, constant interruptions. I’m amazed I never got phished.
• Henchman21 1y ago
  Remember when it was called SINGLE sign on? Emphasis on SINGLE? I mean, this whole idea has been such a mess forever. Why am I prompted to SSO hundreds of times a day?
  • c17r 1y ago
    As far as I've understood/remember SSO was logging on with a single ID and not logging on a single time.
    • bithive123 1y ago
      You are describing "same sign-on", which is generally less desirable than single sign-on, but at least users only have one set of credentials to remember.
    • cesarb 1y ago
      > As far as I've understood/remember SSO was logging on with a single ID and not logging on a single time. What I remember is that the promise of SSO in the 1990s and early 2000s was that you would login only ONCE, onto your desktop. The operating system would use that login to acquire NTLM or Kerberos tokens, which would then be used to authenticate everything else: shared drives, printers, even web sites would be authenticated using that token (there's a way to pass through your desktop NTLM authentication to a web site, which IME is slightly annoying because it authenticates the connection and not the request, and therefore needs keep-alive HTTPS connections to work correctly). Of course, that only really works that well in an homogeneous environment, for instance one in which everyone is using a few Windows NT versions on the desktops and all the servers, or one in which both the desktops and servers use the same specific proprietary Unix variant. What instead happened was the rise of heterogeneous systems, which do not share that common authentication mechanism. To make things even worse, each piece of software has its own separate authentication database, often (but not always) a pluggable one which might perhaps be coerced to forward the authentication attempts to another system, instead of directly using the operating system's centralized authentication mechanisms. AFAIK, you can still make it work, but it's a lot of work (for instance, IIRC forwarding NTLM credentials to web servers is disabled by default, and has to be manually enabled and configured to allow a given web server).
• manish_gill 1y ago
  Okta / Lumos are the biggest offenders of this.
  • mook 1y ago
    I suspect in that case it's to get their name in front of people's faces for marketing purposes. If things are actually seamless enough that you don't need to re-auth, you won't be reminded that their company exists.
• sangeeth96 1y ago
  I disagree with the general advise behind this, even when I'm in a household with trusted (most of the time) family members. Forcing a re-auth ensures that even if I forget to lock my machine/browser, someone can't snoop around. I want this to be the norm especially for my Macbook since for whatever reason, I might forget to lock or have some program running that'll force the laptop to not auto lock out (e.g. while downloading something that takes a long time) so I don't want someone to be able to seize that opportunity. It's the same reason I intentionally lock up apps with TouchID when there's remotely anything sensitive in there. I just don't want someone to be able to snoop if I forget to lock my phone. I'll say however, there should be easier ways to reauth in such scenarios. Like in my case, TouchID is not very disruptive to my work even if a prompt appears. I'll also say it's probably stupid to lock out when there's continuous activity (should lock based on inactivity period). The worst offenders in my experience are banking apps. They: - Force logout sometimes regardless of ongoing activity - Log out as soon as I close the tab - Log out when I press the back/reload button - After logging out, impose a mandatory inactivity period before I can login again (this is just the most idiotic thing EVER) - Use JS to block any kind of copy/paste operation on username/password fields - Never integrate with modern auth mechanisms, not even app-based TOTP! - Have crazy password expiry windows (like every quarter) and force password change when your previous password expires, regardless of how strong they are
  • gs17 1y ago
    > Log out as soon as I close the tab For a banking app, I think this is fine. A lot of people aren't aware closing a window isn't logging out. The rest of that is dumb, though.
    • sangeeth96 1y ago
      Nah, that is dumb too. I get what you’re saying though. They could even ask and confirm if that’s the case while logging in and let me have a persistent session on my own machines.
• gausswho 1y ago
  Pretty rich coming from a company that only let's you create an account via SSO from the largest offenders of this.
  • tayiorrobinson 1y ago
    and also requires you to relogin every so often (to be fair it's 90 days not 24h) and you can just use a custom OIDC IDP with tailscale, for all 15 of us that have custom OIDC IDPs
  • pfych 1y ago
    It at least got me to learn how to self-host my own identity provider!
    • gausswho 1y ago
      Do tell!
      • pfych 1y ago
        I set up Authentik[^1] on my NAS in a docker container and went from there! Just had to add a .well-known webfinger file to my domain that pointed to the Authentik instance and it "just worked" with Tailscale. [^1]: https://goauthentik.io/ https://goauthentik.io/
        • gausswho 1y ago
          Interesting, I'll have to try this. It's still not the anonymity I desire from my private VPN (due to domain requirements) but at least the giants can't rug pull you.
• radicality 1y ago
  This has been bothering me for a while now (few years maybe ?) - websites repeatedly expiring my login for who knows what reason. Sure, maybe I can understand for high value trading platform or something. But no - most mundane sites which most people wouldn’t at all consider sensitive, like HomeDepot / BHPhotoVideo / various online shops, will expire my session within like 24h - seriously, wtf. And significantly more sensitive sites, eg Meta/FB, are usually able to keep my auth for months/years. I haven’t chatted about it with anyone, as I partly wasn’t sure if something in my setup has changed and whether I’m a minority that fell into some constant reauth bucket. Or whether most of site owners have slowly been using lower and lower auth expiration, causing me a bunch of frustration and friction.
  • bdangubic 1y ago
    …high value trading platform or something those are actually ones that don’t do stupid shit like expire passwords… I have had one password for vanguard… and I am in my 50’s :)
• nathansherburn 1y ago
  Wouldn't frequent reauth be beneficial for stolen sessions? E.g. If you set your session timeouts to a ~1 day then by the time your session cookies are up for sale on the dark web, they will be expired. The article doesn't mention this and it's the main reason I advocate for auth sessions that are as short as practical.
  • throw14082020 1y ago
    If your session cookies were stolen, they can be stolen again and again too? Timeouts of 1 day assumes the cookies can only be stolen once.
    • TacticalCoder 1y ago
      [dead]
• yusyusyus 1y ago
  I have really strong opinions against the device-secured biometric stuff. On my own devices, I will never use it as it dramatically lowers my security posture. Further, the development of this ecosystem is to the exclusion of alternative OSes. Windows Hello and whatever apple wants to call their suite of biometric goo is elevating them to a place in my life that is unacceptable by virtue of the unwarranted trust granted to them.
• doodaddy 1y ago
  Zero trust states that you don’t implicitly trust an entity even if they were previously authenticated. So is this a critique of zero trust? More productive might be to say that we shouldn’t blindly force reauth if our risk profile doesn’t warrant it - just like any security mechanism.
• rob_c 1y ago
  Please repeat this to every moron involved in security theatre. This is turning into a pain in the ass in the industry for no reason
• exabrial 1y ago
  lol tell that to the people that want 15 day length TLS Certs.
• thwarted 1y ago
  The MFA is getting out of control too. Go to vendor's tool/website, which uses some SSO method and redirects/prompts me to login with the SSO provider. Authenticate to SSO providers, which requires an MFA. Redirects me back to the vendor's tool/website, which prompts for its own MFA. And the vendor's tool's configuration has a security setting that requires all accounts to have MFA, even if they are authenticated via other means.
  • MBCook 1y ago
    I need to use SSO with MFA for something. So I sign in. Every once in a while, the token attached to that somehow expires. Which means that once I have successfully signed in (but before doing MFA) I am redirected to a DIFFERENT SSO system. I get to login to that and enter its MFA code. Having now completed all security requirements. I get to enter the MFA code for the original SSO. Double SSO. Double MFA. Boy don’t we feel secure.
  • __turbobrew__ 1y ago
    I have this at my work. One system requires SSO so I go to the SSO gateway, touch my yubikey to login to SSO, and then I am redirected back to the original app, and it also wants my yubikey so I touch it again, and then I am finally granted access. The root of trust is my yubikey in both cases but the implementation was lazy. I brought this up to our security team and they shrugged.
• bravesoul2 1y ago
  They dodged what to do about SSO and SAML. With SAML I don't necessarily know (as a coder) who will be the IdP or what protocol there will be for up to date authorisation info.
• hashstring 1y ago
  There’s another closely related one, changing passwords periodically. A lot of infosec authorities move away from this. However, I always wonder, does it make sense for an org to stop with periodic password resets if: 1. the org is not very capable in detecting all account compromises; 2. in practice, users leak their passwords (e.g. by getting phished) and not all of them lead to direct intrusions, some credentials are sold first and it may take weeks/months to cause an intrusion. I believe that in practice, forced password changes at least ensure that unknown compromised passwords will become outdated at some point in time, and I think that this is positive. Ultimately, I believe the best thing to do is to move to FIDO2-authentication here. But I do wonder what are other peoples takes on this topic?
  • awesome_dude 1y ago
    > I believe that in practice, forced password changes at least ensure that unknown compromised passwords will become outdated at some point in time, and I think that this is positive. password password1 password2 password! Password1! People get predictable on how they modify their passwords when that policy is instituted. Mostly because it's a royal pain in the ass to have to generate a new password AND remember it. That was one of the reasons that browsers (etc) began offering users randomly generated passwords that either the browser, or a 3rd party tool/service recalling the password on demand. However that then means the password to the browser/service becomes the unchanging password... > Ultimately, I believe the best thing to do is to move to FIDO2-authentication here. Passkeys are an attempt to circumvent this by having (effectively) a key that's attached to some physical device that the user must have access to to prove that they are the authorised user... but... people are circumventing those by storing them in cloud services... which means that the password to the cloud service is... yet again.. the weak point. > But I do wonder what are other peoples takes on this topic? For my money, the problem that's being attempted to be solved is unsolvable. In the physical world we determine identity by citing documents that verify the identity as far as a trusted institution like a government or bank is concerned, and those documents are predicated on documents that may or may not exist (birth certificates) and the assurance that those documents are for the person presenting them, from other people that have been through the same procedure. The digital world is even more difficult to prove identity with, because everyone looks exactly the same, ones and zeros, the order might be different from one person to another, but they're mutable.
• almosthere 1y ago
  Finally someone said it. This is a relic from when a row in a database table for a session id cost about $400. I'm joking of course but that's what literally was on the mind of early internet engineers. The only company that fights this is Google and apparently tailscale.
  • eab- 1y ago
    The same Google that makes you log in again on like every other `gcloud` call? By copy pasting your password into the shell prompt?
  • MBCook 1y ago
    Microsoft does too. And Apple (but they’re not big in enterprise, of course). Unfortunately lots of compliance people/orgs don’t seem to want to give it up.
• redsymbol 1y ago
  Zoom has been driving me nuts with this lately. I have to reauth with OTP 3 times a day, while logging in on the same computer on the same LAN with the same browser. I spend over $1500 a year with Zoom, and this issue is seriously making me think about how I can migrate to something else.
• vizzah 1y ago
  I just can't stand email OTP. Before we had passwords, now we have passwords + email OTP. And doesn't matter if you forgot password - you will receive password reset to the same email. You already prove email ownership by resetting or using password - why sending another useless "security token" to the same email. Pure nonsense. Whoever designs all of this clearly has little idea of what they are doing :(
  • TylerE 1y ago
    I’ve kind of become a fan of the sites that don’t even have passwords but just email you a “magic” link. If my account security is tied to my email why make me do extra song and dance if I’m gonna have to fish out an email for every login anyway?
    • kevincox 1y ago
      I despise this. With username and password my password manager just fills it in and it is one click to click "login". With email magic link I need to enter my email (it seems to rarely auto-fill for some reason), then wait (often it takes 10s for the email to be sent for some reason), then if I was logging in on something that isn't my default browser I need to copy+paste the link (often just clicking the link authorizes the source session but not always and you don't know what this site does so you need to do it to be safe). Now you are finally logged in but probably have two tabs open. Either you need to find the first one to continue your session (if it logged that one in) or close it and lose your history for that tab (and hope that the website actually maintained your target page which more often than not it didn't).
      • radicality 1y ago
        And on top of that, the session is probably gonna expire in less than day. I hate logging in to Anthropic because of this signin-email dance
      • TylerE 1y ago
        My point is that on sites that force email 2FA you have to do the email dance anyway. A username and password are basically theater.
• arianvanp 1y ago
  And then there is AWS which has 3 different products to log in and will sign out randomly and then redirect you to the wrong login page seemingly at random whilst in the middle of incident response
• montebicyclelo 1y ago
  Forced password rotation and expiry seems the bigger problem; given that it causes people to get locked out so often, (e.g. if pw expires when on holiday), — often then requiring travelling to IT, or at least a few hours trying to get IT on the phone to reset, or chasing up colleagues who aren't locked out to get in touch with IT. Many (most?) companies still do it, despite it now not being recommended by NIST: > Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically) https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html Or by Microsoft > Password expiration requirements do more harm than good... https://learn.microsoft.com/en-us/microsoft-365/admin/misc/password-policy-recommendations?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/admin/misc/p... But these don't seem to be authoritative enough for IT / security, (and there are still guidelines out there that do recommend the practice IIRC).
  • throwaway843 1y ago
    1234abcd@ it is then for all my accounts.
    • xp84 1y ago
      Password rotation does nothing more than get you to use 1234abcd@ 1234abcd@1 1234abcd@2 1234abcd@3 I'm becoming pretty convinced that at least in the corporate space, we'd be way better off with a required 30 character minimum password, with the only rules being against gross repetition or sequences. (no a * 30 or abcd...yz1234567890 ). Teach people to use passphrases and work on absolutely minimizing the number of times people need to type it by use of SSO, passkeys, and password managers. Have them write it on a paper and keep it in a safe for when they forget it. This is a better use of the finite practical appetite for complying with policies than the idiotic "forcibly change it every 90 days" + "Your 8 character password needs to have at least one number, one uppercase, and one of these specific 8 characters: `! @ # $ % ^ & *`" By the way, to quote Old Biff Tannen, "oh, you don't have a safe. GET A SAFE!"
      • kobieps 1y ago
• kwanbix 1y ago
  I just joined a fintech company. It is so crazy, everything logs out daily, to login you have to input a complex password plus the 2FA, you have to run everything through a Citrix VDI. Really bad.
  • nofunsir 1y ago
    Only once a day? Sounds heavenly. Try every time you turn around and use your air-gapped dev PC for 5 minutes, while trying to keep a reference PDF from online up on your corporate PC to read.
• garyfirestorm 1y ago
  I hate the corporate office 365. How many times on the same corporate laptop on which I log in from home do I need to reenter outlook password and 2FA. I seriously think ms365 login chain is straight broken Click here to sign in - enters userID and pass - thanks for logging out :o
  • ExoticPearTree 1y ago
    You should be angry at whoever set it like that. In O365 you can sessions last as much as you want. Currently MS recommends a 90 day window between MFA re-authentication for known devices/browsers you already authenticated on.
• notfed 1y ago
  Here's 2 or 3 cents: - Websites should (in agreement with TFA) just remain logged in (at least for 24 hours). Let the OS handle it. - Public computers should only ever provide ephemeral login sessions. Everything cleared upon each login. Never persist anything to disk. - Personal computers should reauth frequently, but should use adaptive authentication: i.e., password sometimes, and pin/fingerprint other times, where reasonable. Since "reasonable" is debatable, this should be configurable by the user at the OS level.
• WarOnPrivacy 1y ago
  From the article: Now that most OSes can unlock with just a fingerprint or face, there's no reason to leave your screen unlocked when you walk away. This statement seems to be unaware that workstations are a thing. In 30 years of onsite support, I think I've seen one desktop PC with a fingerprint scanner. Cameras aren't ubiquitous either. Across the 5 locations I currently service, less than 2 percent of desktop PCs have a camera. Past that, I believe there is a secondary challenge with face scanning; it's the unsettlement factor. I suggest that discomfort with face scanning is reasonable and earned. The reason: We're constantly subject to face scanning that is non-consensual, intentionally hidden from us and is probably exploitative. Cams also enable snoopy bosses, school admins, corps, LEO and Govs to endlessly peer where they should not. And even where we own our devices, we don't fully control them. Software corps have no ethical boundaries. Any assumptions that they'll respect us - at all - isn't based on reality or history. For workstations, I like security keys.
  • projektfu 1y ago
    If an organization wants fingerprint scanners, they just have to provide them. It's about $15-50 per workstation, if desired. The main problem is they use up an increasingly scarce USB port. Some scanners also rely more on security by obscurity rather than protecting the channel. https://www.google.com/search?q=windows%20hello%20fingerprint%20reader%20man%20in%20the%20middle https://www.google.com/search?q=windows%20hello%20fingerprin... It would be worth doing research to find the best fingerprint scanner that implements this well. Face scanning is a poor solution because desktops usually do not have Hello-compatible scanners and the scanners on the Windows laptops aren't very good. They frustrate users who prefer darkened rooms or who sit in places with varying contrast from the windows. It is also weird the way the camera is constantly trying to find you, and so it blinks its red LED frequently until the computer goes to sleep. Just really agreeing with you on security keys, but we also have to make sure they are really secure. Also, like the article says, they give you the device possession part, but not the user ID part, unless they have a biometric device built in.
    • simoncion 1y ago
      > The main problem is they use up an increasingly scarce USB port. This logic I do not understand. USB hubs exist and are more-or-less commodity parts these days. [0] I'd be surprised if the fingerprint reader was anything faster than USB 2.0, and deeply offended if the reader did anything other than idle on the bus when it's not being used... so you're not going to be suffering any real bandwidth contention by putting that guy and a USB 3.x device on the same hub. [0] They're also usually how motherboards that have a whole bunch of USB ports hook those ports into the onboard USB controller(s). (Do folks usually think that every one of the 10gbit/s ports on one's desktop machine could be simultaneously run at 10gbit/s?)
• osigurdson 1y ago
  Google hasn't asked me to re-enter my password for years. If your users are the product this must make financial sense.
• aljgz 1y ago
  Something related that's barely touched in the post: Bad UX is potential security vulnerability. If your system behaves in unreasonable ways, users are much less likely to notice when it behaves in a slightly different unreasonable way, this time because of a spoofing/phishing, etc. The obvious example: if your system frequently asks for passwords, re-entering passwords becomes a habit (read system one from "thinking fast and slow"), and the user is less likely to use judgement each time they enter the password. But also, if an OS makes it hard to find all startup applications, allows untrusted code to run in the background without any visible signs, allows terminal code to access all local files by default, etc etc these all can be abused. One problem is that human psychology is rarely considered as important a factor as it should be by the average security expert. The other is the usual suspect: incentives. The right chain of responsibilities is missing when things go wrong for people because of mistakes that would be avoidable by proper product design. Regulation should enforce that, but while everyone would benefit from regulation, no one likes the regulation that will regulate the product/services they offer, and the supplier has upper hand when a change in regulation is being considered because they are focused and motivated.
  • benrutter 1y ago
    This is a great take! Similarly, I've seen shadow IT and sneaky work around type stuff crop up a lot before because the "official" way of doing something has picked up too much friction.
• TacticalCoder 1y ago
  [dead]
• jaydenmilne 1y ago
  Microsoft has ruined their PC games with this. I hesitate to fire up Minecraft or Master Chief Collection these days because I just _know_ it is going to make me reauth for no apparent reason. I took 2FA off my Microsoft account because of this, so congrats. These are a video games, not a bank account! Please just let me have fun!
  • candiddevmike 1y ago
    Yea, it's nuts having to reauthenticate constantly on an Xbox, especially with a randomized password. They changed it recently where you can scan a QR code I guess, but whoever implemented that system is completely disconnected from reality.
• tlogan 1y ago
  Sure. All true. But PCI compliance requires 90-day password rotation which might not be required if you’re using multi-factor authentication (MFA). In other words, in the case of MFA, that requirement might be waived: and the operative word here is might. So, if you’re pursuing PCI compliance people don’t rely on assumptions or conditional language like might. Certainty is key when dealing with compliance frameworks.
• TheBicPen 1y ago
  Very confused about this point: > Passwords, Face ID, Touch ID — things that supposedly nobody but you can replicate, but which don't prove you're physically near a given device Password, sure. But the other 2 surely prove that you're both 1) the correct person and 2) near the physical device that scans your face/fingerprint. The article immediately follows that by saying that face/touch ID do both.
• 1Sebastian 1y ago
  [dead]
• b0a04gl 1y ago
  [dead]
• jillesvangurp 1y ago
  A curious thing with security is that a lot of measures companies take aren't about your security but about liability and control. Most security theater is motivated by that. Your inconvenience is collateral damage to that. Apple and Google don't worry about you getting hacked but about you suing them after you get hacked. That's the risk they are mitigating. Or worse, you jumping ship to the competitor. They want you dependent on your account with them. So, when Google single signs you out mid meeting (has happened to me), they don't care about how stupidly annoying that is. That's just them asserting that if anything bad happens to you, it was your own fault and not their failing. And then a secondary thing that makes life even harder is that instead of working together they are considering single sign on mechanisms as control points that they can leverage to keep the relationship with 'their' users exclusive. So Google and MS both do very similar things but they don't trust each other's Identity Providers (IDP). That's not an accident. That's intentional. MS has been on a decades long mission to 'own' all logins, and of course they've been failing to get there just as long. Likewise, Google and Meta have been fighting over this as well. And the net result is that you don't have just 1 account to worry about but gazillions. That's why every silly little app has its own stupid email/password thing and why onboarding friction is the biggest hurdle to users adopting these. These are the primary motives driving this mess. Companies don't collaborate, so security stays complex and messy. It's also the reason that passwords (long discredited as a reliable way to authenticate) are still a thing. If we had effective federated IDPs like OpenID where everybody could use and IDP of their choice and use it to authenticate it with pretty much everything and the kitchen sink, you wouldn't be using passwords ever. That was envisioned as early as 20 years ago. Google, MS, Meta, etc. blocked every attempt to make that happen by never mutually trusting each other, or any other IDP not operated by them. They all implement some version of OpenID 2.0 (with enough differences to make supporting all of them a bit of a journey) but they deliberately don't whitelist any external IDPs and jealously continue to fragment the security landscape by guarding their walled gardens. They've been engaging with each other in backroom standardization attempts ensuring that the status quo is never allowed to change for decades. The latest move in this war: pass keys. Nice solution on paper. But you got to have the Google version of it. And the MS version. And all the rest. Sigh. Because, obviously, by design these will never delegate to each other. They trust each other even less than they trust you.
• flashblaze 1y ago
  Might be tangent, but Cursor has this the worst. Each time you close the browser and open, you're logged out. I have no idea why they do this.
• latchkey 1y ago
  Google Workspace defaults to making you sign in every 2 weeks unless you have a certain upper tier of paid account with them. Even worse is that if you try to search for the feature and click on it, it presents a page that unhelpfully returns 404. It's annoying AF. "By default, the web session length for Google services is 14 days." https://support.google.com/a/answer/7576830?hl=en https://support.google.com/a/answer/7576830?hl=en
• ianopolous 1y ago
  Humans shouldn't generate passwords. ~0 people are good at that. Websites should just generate a password for a user, letting them regenerate as many times as they like until they get one they like (without breaking password manager based generation). A bit like this: https://peergos-demo.net/?signup=true https://peergos-demo.net/?signup=true
  • baq 1y ago
    ~0 people want to remember passwords. generating passwords for them without offering to securely store them in a password manager strikes me as misguided.
    • ianopolous 1y ago
      People should absolutely be using password managers where possible. A website doesn't have control over whether you are using a password manager though. This is about stopping the human from generating a password themselves, which will be terrible.
      • baq 1y ago
        I mean, at this point might as well drop the password requirement completely and send an email login link every time a user gets logged out and wants to log back in. It's how 'reset password' feature works for some people anyway.
        • ianopolous 1y ago
          Yep, if that's possible for your service that works. If the service doesn't want your email and/or doesn't have access to your data, e.g. an E2EE service where account reset is impossible, then that's not an option. The supposition for all this is that the service wants to use passwords for whatever reason. In that case, generate them for the user.
• hananova 1y ago
  The previous company I worked for did this kind of frequent expiration, made for a good 2-3 days off every 3 months because I sure as hell wasn't going to set an alarm on the date.
• briffid 1y ago
  I'm so tired of the enforced password changes, that I just write them on a post-it note now.
• perlgeek 1y ago
  Stealing session tokens is a common technique to get around MFA, deployed by malware everywhere. I don't like it, but frequent reauth does limit the blast radius of stolen session tokens.
• jeroenhd 1y ago
  Needless to say, this is an ad for Tailscale. I hate these short-lived sessions myself, but there are oftenreasons why they're there. The alternatives proposed are "just always check right before a sensitive action" and "use continuous verification". Both of which are much harder to pull off correctly than short-lived authentication sessions (unless you buy their product, of course, supposedly), especially on third-party services you don't control the source or manage the deployment for. Oh, and of course, "just make everyone lock their screens". If only it was that easy. If basic rules like that worked, we could ditch half the security measures we have for websites. What's next, "just use unique passwords of 20+ characters for each website"? Also, this is putting a lot of trust in solutions like Windows Hello. I can't speak for the security of Apple's implementation, but thanks to bad vendor implementations (including Microsoft's own!), Windows Hello hardware is full of security holes. At some point one company decided to take a look at a few of those devices [and found security problems in all of them](https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/ https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/). Short token longevity also protects against one use risk Tailscale have a solution for: users logging in to their personal accounts on public computers. That's still an essential use case for people without internet access or computer access at home. Often these people are more vulnerable (homeless, very poor) so relying on them clicking the "log out" button on every website they're forced to interact with is not going to work. Kerberos (or buying what Tailscale sells) does offer a somewhat nicer authentication flow, but that still doesn't work reliably on every browser on every OS on every device and it requires people to follow basic rules like "lock your screen", which is a massive risk. Passwords will always work anywhere and their security can be somewhat enforced.
• LinAGKar 1y ago
  Does that mean Tailcale will stop doing it? Currently they require you to log into every node and reauthenticate it every now and then, unless you disable key expiry.
• nottorp 1y ago
  That's okay, soon we'll have 8 hour ssl certs to go with this crap.
• ajsnigrutin 1y ago
  OnShape (web based 3d editing software) is like this. They have a free tier with public-documents-only option, and it's same there. Open the page... you have to log in, no way to remember you. Sure, you save your password in the browser, but unless you then also click into one of the input fields, the login button is disabled. Then you work on some 3d stuff, export the file, send it to the 3d printer, some time goes by, browser still open, you get the object, and the holes don't line up, you forgot the wall thickness in the measurements, calipers, yep, 3 more milimeters... open onshape tab, nope, you've been logged out. I didn't even close the goddamn window/tab, it's a free account editing a public document.
• btbuildem 1y ago
  > Consider enforcing automatic screen lock when you walk away The corpo "security" dingbats force this on our work machines via profiles -- can't control how long before the screen locks. Thank goodness for the Amphetamine app. I'm not typing in my password every time I stop to think for two minutes, you can fuck all the way off with that.
  • Nextgrid 1y ago
    If you're using a Mac, I find the fingerprint sensor helps a lot.
• phkahler 1y ago
  No, but it's a good excuse to require MS authenticator on my phone...
• tom_m 1y ago
  I don't know, I still think it's a good idea to change passwords every so often. At the rate databases get leaked, you can't always rely on the strength of the hash and the time it used to take to crack given hardware getting faster and faster. Yes it can cause a minor inconvenience if locked out, but that's better than the alternative depending on what that system was. But...worry not, we're about to embark on a world with a whole lot less security now thanks to AI and laziness.
• Aissen 1y ago
  OWASP still recommends regular expiration: https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#session-expiration https://cheatsheetseries.owasp.org/cheatsheets/Session_Manag...
• temporallobe 1y ago
  This kind of goes along with my ongoing pet peeve about DX in general. There are very few organizations I’ve worked with that actually care and put their devs first. Case in point, I worked on a contract a few years ago with very frequent reauths where you had to enter your PIV card PIN about every 30 min. Obviously something was not configured correctly, but when we complained we were told that that was their security policy and to go pound sand. It made everyone so frustrated that productivity took a huge nosedive. I remember one day I was in the middle of trying to analyze something very tedious and having anxiety about the next time that dialog would prompt me for my PIN. Sure enough it happened, and I just gave up. I left my laptop, took a walk, and did nothing for the rest of the day. Eventually someone important petitioned for us and it was fixed, but I can’t begin to calculate how much money this wasted in terms of unproductive contract hours.
• taniks1618 1y ago
  I very much agree with this article. But many companies are still under the idea of a complex password, instead of a long one. A "secure" password is not random character vomit. A secure password is a pass-phrase with multiple words and characters intermingled.
• einaralex 1y ago
  Looking at you Beatport!
• tacitusarc 1y ago
  A minor recommendation: remove the word “just” from the following paragraph. > At Tailscale, we believe in security that’s adaptive, intelligent, and actually useful — not —just- security theater.
• jandrese 1y ago
  IMHO there are only 2 requirements for a good password: 1. It must be close to impossible for a computer to guess. 2. It must be easy for a human to remember. Virtually all password policies focus exclusively on point #1, with the vast majority just giving cargo cult instructions without really understanding the state of the art. Almost nobody puts any emphasis on point #2, which is arguably more important as it is the source of most breaches. If a person can't create a password, ignore it for a week, and then remember it immediately for the next login it's a bad password. This is where requirements like "no more than two characters from a character set (lower case, upper case, numbers, punctuation) in a row" are actively counterproductive. If the password has to be so convoluted that the user is forced to write it down then you've undermined your own security. Worse, it means the help desk will be forced to reset many many passwords which increases the chances of an impersonation attack succeeding.
  • deleted 1y ago
    [deleted]
• benced 1y ago
  Funny because tailscale arbitrarily expires tokens on machines and doesn’t expose a way to see token age to the user (but does allow your IT admin to renew a token).
• worik 1y ago
  My personal pet peeve is restrictions on what characters can go, have to go, into a password Security theater, not really as it makes passwords less secure
• motohagiography 1y ago
  recently came to appreciate the irony in proving who we are via catchpas, password complexity, and context switching 2FA is that any security method without personal irritation will get automated and broken. therefore, all security requires for us to prove the authenticity of our being by demonstrating suffering somehow- and an authentication method without evidence of suffering cannot prove we are real. it's funny, but tracks infosec life pretty well, that we've stumbled into a proof that the necessary condition for a system to verify we are alive and are our authentic being is to offer up some minor suffering to it.
• h4kunamata 1y ago
  Anything that generates fatigue doesn't work. Passwords expiring every 2 months?? Users will user password like "test1" "test2" test3" and so on. Companies don't even have a password manager so few employees use the browser to save passwords, others use their own password manager which comes with its own security risks like that service, LastPass IIRC, that got breached. When working for big companies, there are so many wrong processes and practices which provides the bare minimal and that is fine. Support team cannot care to report the problems coz they don't wanna more work, my laptop always connect to a restricted network while in the office which kills internet access to everything, that in turn cause the laptop to take 20-30 to turn own while it tries to run AD policies. The whole process is broken within the companies culture, keep it minimal, repetitive and that "should work, next"!