Re:Frequent reauth doesn't make you more secure
by valenterry on Thursday June 12, 2025 @03:53PM
(#44262440)
This is spot on. And it's a general misunderstanding of security in practice. Availability is often missed/ignored (but it is part of security) and attention is an important currency that needs to be treated carefully - or you and up with the mentioned MFA fatigue attacks or people writing down their passwords.
[ Parent
| on HN ]
Re:Frequent reauth doesn't make you more secure
by jeremyjh on Thursday June 12, 2025 @03:59PM
(#44262490)
The most secure thing would be to unplug the servers.
Re:Frequent reauth doesn't make you more secure
by circular_logic on Friday June 13, 2025 @09:13AM
(#44268226)
I have tried to point out that poorly implemented or non contructive security controls reduce system availability. As employes are not able to get to the information they need in a timely manner.
But it's been a dead end to many an argument. For some the underlying issue is a refusal to accept that product usability and security are not mutually exclusive and a difficult to use system just leeds to grey IT in the org.
The most odd reply I have received was pedantics on the definition of security availability, i.e.,
"Ensuring data and network resources are accessible to authorized users when needed"
Beacause it contains the word "authorized" any controls for authorisation can therefore never affect availability as they have to be authorized before we can consitter it an impediment to availability...
If anyone has a reply better than that's ridiculous, please help me here