Frequent reauth doesn't make you more secure (tailscale.com)

Article summary

The article argues that frequent reauthentication does not necessarily make users more secure and can actually weaken security posture by creating frustration and encouraging poor security habits. It suggests that security should be continuous and adaptive, rather than relying on frequent login prompts. The article proposes using real-time security checks and device posture checks to update security attributes and policies without user interaction. This approach can provide stronger security guarantees without annoying users.

Main themes

• security vs usability
• authentication methods
• session management
• token revocation
• real-time security checks
• device posture checks

What commenters say

• Frequent reauthentication is not an effective security measure and can be frustrating for users.
• Session cookies are often misunderstood, and their definition can vary depending on the context.
• Refresh tokens can be used to improve security and reduce the need for frequent reauthentication.
• Some argue that revoking sessions in real-time is more important than frequent reauthentication.
• Others believe that having both expiry and revocation capabilities is the best approach.
• Stateless auth protocols can make it difficult to revoke tokens in real-time, leading to workarounds like short session expiry.
• Caching tokens in memory can improve speed, but also introduces complexity and cache invalidation issues.