Short session expiration does not help security (sjoerdlangkemper.nl)

Article summary

The article argues that short session expiration times do not significantly improve security and may even have negative consequences, such as poor user experience and increased risk of password compromise. It suggests that other security measures, like disk encryption and secure logs, are more effective in preventing session takeover. The article also notes that large companies like Google and GitHub do not use short session expiration times, implying that they may not be necessary. The author concludes that session expiration times should be determined based on the specific needs and risks of each application.

Main themes

• session expiration
• security vs usability
• defence in depth
• adaptive security
• threat modeling
• risk management

What commenters say

• Short session expiration times do not prevent attackers from achieving their goals and may only slightly limit the time they have to act.
• Prioritizing security over user experience can be counterproductive and may drive users to bypass security controls.
• Defence in depth is a good security principle, but it should be applied in a way that considers the actual risks and benefits of each control.
• Adaptive security, which adjusts the level of security based on the specific action or context, may be a more effective approach than uniform session expiration times.
• The effectiveness of short session expiration times depends on the specific threat model and the likelihood of session compromise.
• Overly restrictive security measures can be frustrating for users and may not provide significant security benefits.
• Security should be balanced with usability and business needs, rather than being prioritized above all else.
• Quantitative approaches to security, such as risk management and threat modeling, can help to make more informed decisions about security controls.