Re:A digital skeleton key to access any website
by ianlevesque on Saturday May 09, 2015 @05:17PM
(#9517710)
The #1 reason I prefer mobile apps to web apps is because even those that require sign in will remember my login permanently. The entire rest of the web (with rare exceptions) all seems to believe that it's acceptable to require re-login over and over and over. I've drastically reduced the number of sites I use just to end the madness, even with 1Password. How is this still not solved in 2015?
[ Parent
| on HN ]
Re:A digital skeleton key to access any website
by whoopdedo on Saturday May 09, 2015 @06:27PM
(#9517931)
How long until someone learns to use replay attack to hijack sessions from a mobile app?
I'd say about half, probably more, of the web sites I log into are able to hold the session for an extended period of time. A few are very aggressive about expiring cookies and often it's because my IP address changes. Those sites are also ones that deal with frequent spamming or DDoS.
On the other hand, frequently having to login helps me remember my passwords. I can tell you right now I probably won't get into HN on the first try because I haven't had to type the password here for over a year.
Many websites don't seem to have mandatory session expiry. I have Firefox set to clear everything except cookies and site preferences when I close my browser, and then set cookies to "until I quit Firefox", with exceptions for sites I want to stay logged in to (reddit, HN, few other non-critical but frequently visited sites) set to "allow".
Self-destructing cookies to purge cookies from closed tabs after a timeout is also a useful extension.
Re:A digital skeleton key to access any website
by signaler on Saturday May 09, 2015 @05:29PM
(#9517751)
Hey author here. All valid points. I see you made a tradeoff there. So you asked how is this still not solved in 2015? Did you mean rhetorically, as in, you use your phone for logging in so your problem is solved, or you want to see a skeleton key system built?