Re:Short session expiration does not help security
by lucascantor on Friday August 18, 2023 @10:40AM
(#37176305)
This is why I prefer short sessions and requiring frequent, passwordless, biometric authentication. Still relatively low friction for the user, and no password to remember or forget, while still reasonably high friction for an attacker.
Re:Short session expiration does not help security
by klodolph on Friday August 18, 2023 @10:24AM
(#37176052)
> One beef I have with short session expiration, though, is that in many cases it causes people to degrade security.
One counterpoint—if sessions last too long, then I forget the password, and reset the password. If sessions are too short, then I choose an insecure password. Neither option is great for security!
Talking about systems for which a password manager doesn’t make sense, like your lock screen password.
Re:Short session expiration does not help security
by konschubert on Friday August 18, 2023 @11:30AM
(#37176989)
If you're remembering your passwords then you are probably using insecure passwords or are re-using passwords across multiple services.
Re:Short session expiration does not help security
by GoblinSlayer on Friday August 18, 2023 @11:33AM
(#37177035)
What you don't like in the first option? If you need password reset feature, then it's necessary. If you don't need it, then remove it.
If you don't have mathematically secure solutions, session expiration and similar are the imperfect tools you use to solve your problem.
One beef I have with short session expiration, though, is that in many cases it causes people to degrade security. This happens when people get annoyed by having to frequently provide their credentials and rather than enter credentials securely, use even more insecure workarounds.