4 ms·

The #1 reason I prefer mobile apps to web apps is because even those that require sign in will remember my login permanently. The entire rest of the web (with r

The #1 reason I prefer mobile apps to web apps is because even those that require sign in will remember my login permanently. The entire rest of the web (with rare exceptions) all seems to believe that it's acceptable to require re-login over and over and over. I've drastically reduced the number of sites I use just to end the madness, even with 1Password. How is this still not solved in 2015?

signaler 11y ago
Hey author here. All valid points. I see you made a tradeoff there. So you asked how is this still not solved in 2015? Did you mean rhetorically, as in, you use your phone for logging in so your problem is solved, or you want to see a skeleton key system built?
deleted 11y ago
[deleted]
btdollar 11y ago
I delete and give one star to any mobile app that requires a registration.
asanagi 11y ago
Because the government absolutely will not educate the people in the use of public key cryptography. This is because they cannot break it themselves.
whoopdedo 11y ago
How long until someone learns to use replay attack to hijack sessions from a mobile app? I'd say about half, probably more, of the web sites I log into are able to hold the session for an extended period of time. A few are very aggressive about expiring cookies and often it's because my IP address changes. Those sites are also ones that deal with frequent spamming or DDoS. On the other hand, frequently having to login helps me remember my passwords. I can tell you right now I probably won't get into HN on the first try because I haven't had to type the password here for over a year.
nly 11y ago
Many websites don't seem to have mandatory session expiry. I have Firefox set to clear everything except cookies and site preferences when I close my browser, and then set cookies to "until I quit Firefox", with exceptions for sites I want to stay logged in to (reddit, HN, few other non-critical but frequently visited sites) set to "allow". Self-destructing cookies to purge cookies from closed tabs after a timeout is also a useful extension.

signaler 11y ago

Hey author here. All valid points. I see you made a tradeoff there. So you asked how is this still not solved in 2015? Did you mean rhetorically, as in, you use your phone for logging in so your problem is solved, or you want to see a skeleton key system built?

deleted 11y ago

[deleted]

btdollar 11y ago

I delete and give one star to any mobile app that requires a registration.

asanagi 11y ago

Because the government absolutely will not educate the people in the use of public key cryptography. This is because they cannot break it themselves.

whoopdedo 11y ago

How long until someone learns to use replay attack to hijack sessions from a mobile app? I'd say about half, probably more, of the web sites I log into are able to hold the session for an extended period of time. A few are very aggressive about expiring cookies and often it's because my IP address changes. Those sites are also ones that deal with frequent spamming or DDoS. On the other hand, frequently having to login helps me remember my passwords. I can tell you right now I probably won't get into HN on the first try because I haven't had to type the password here for over a year.

nly 11y ago

Many websites don't seem to have mandatory session expiry. I have Firefox set to clear everything except cookies and site preferences when I close my browser, and then set cookies to "until I quit Firefox", with exceptions for sites I want to stay logged in to (reddit, HN, few other non-critical but frequently visited sites) set to "allow". Self-destructing cookies to purge cookies from closed tabs after a timeout is also a useful extension.