Thread

Loading the complete thread in the background. This saved snapshot is available now. Refresh

1. pluc · 1790956484 · focus · HN ↗

   Never accept cookies from strangers.
2. tonetheman · 1790957052 · focus · HN ↗

   [dead]

3. Dwedit · 1790957645 · focus · HN ↗

   I mean 20 year cookies make sense for a logon cookie, but not something given out to guests.

   1. JSR_FDED · 1790958672 · focus · HN ↗

      The “SI” apparently disagrees
   2. verandaguy · 1790958714 · focus · HN ↗

      Why do they make sense as logon cookies?

      1. EGreg · 1790959005 · focus · HN ↗

         Why not?

         1. lokar · 1790959382 · focus · HN ↗

            The burden is to justify it.

            What technical reason is there?

            1. bsoqk · 1790959568 · focus · HN ↗

               How long should a cookie you expect to last forever actually last?

               1. pixelatedindex · 1790959914 · focus · HN ↗

                  Why should it last forever?

                  1. bsoqk · 1790960411 · focus · HN ↗

                     Because when you log in you don’t want to be logged out at (what, for you, will appear to be) a random time of the future.

                     1. verandaguy · 1790960886 · focus · HN ↗

                        The solution here is a "keep me logged in for 30 days" or "remember me for 7 days" label on the checkbox, not a forever cookie.

                        1. bsoqk · 1790960950 · focus · HN ↗

                           That’s a solution for a problem that doesn’t exist. Nobody considers not getting logged out randomly a problem.

                           1. pixelatedindex · 1790962844 · focus · HN ↗

                              You said > Because when you log in you don’t want to be logged out at (what, for you, will appear to be) a random time of the future.

                              And

                              > That’s a solution for a problem that doesn’t exist. Nobody considers not getting logged out randomly a problem.

                              Isn’t this contradictory? The double negatives are really throwing me for a loop. Regardless, it’s extremely common for you to be force-logged out of a session for any portal that has sensitive info. You’re never logged into your bank forever, SSO logins expire. The ones that don’t expire are stuff like YouTube or Netflix, but only if you use it (length of refresh token validity).

                              I do not understand your thesis.

                           2. verandaguy · 1790962849 · focus · HN ↗

                              Just because it's not considered a problem by people without a technical or security background doesn't mean it isn't one.

                              We make many UX compromises in the name of security, and this is a place where that is most visible.

                              1. rpdillon · 1791041097 · focus · HN ↗

                                 But security is context-dependent. How often does HN log us out?
                        2. rpdillon · 1791041054 · focus · HN ↗

                           That solves "random" but not "I don't wanna type my password every week".
                     2. lokar · 1790961770 · focus · HN ↗

                        You think login.gov (Medicare, social security, tsa, irs, etc) should leave people logged in forever?
         2. verandaguy · 1790960188 · focus · HN ↗

            Because in most security models, access is often time-limited.

            30 days, for example, is quite long, though NIST does identify 30 days as being the maximum recommended auth token lifetime for low-risk environments.

            Higher-risk environments come with 24-hour and 15-minute lifetimes, for context.

4. ape4 · 1790957843 · focus · HN ↗

   Of course, America.gov uses "SI". From its FAQ: America.gov uses SI to find and explain information from official government sources. SI can make mistakes, so check the sources included with each answer before making an important decision. To report a problem, select the feedback button below the answer and describe what was incorrect or out of date.

   1. actionfromafar · 1790958790 · focus · HN ↗

      Shit Intelligence?

      1. wholinator2 · 1790959686 · focus · HN ↗

         Supreme Idiocy, Superego Incinerator, Still Incomplete...
      2. VCFundedGenYer · 1790959870 · focus · HN ↗

         Sports Illustrated often makes mistakes.
      3. treetalker · 1790963500 · focus · HN ↗

         Saffron Impersonator
      4. neuronexmachina · 1790963925 · focus · HN ↗

         Slop Induction
      5. cindyllm · 1790968336 · focus · HN ↗

         [dead]

   2. kajman · 1790961261 · focus · HN ↗

      This should be updated. It appears they've removed the regex triggered easter eggs, and it's well known that a Super Intelligence system is a combination of off the shelf LLM and hand written regex cases.

      Or hand-prompted, more likely.

5. fuzzythrowaway · 1790958866 · focus · HN ↗

   [dead]

6. ukusormus · 1790959267 · focus · HN ↗

   Most browsers cap cookies' max lifetime to 400 days or less these days
7. bsoqk · 1790959517 · focus · HN ↗

   If this is the worst thing they’ve found in that portal…
8. integrallis · 1790960756 · focus · HN ↗

   This is nothing but an attempt to disenfranchise minorities and people living paycheck-to-paycheck that can afford the time to deal with yet another ID... this is an old technique, just like gerrymandering, poll intimidations, and the all the tactics republicans have been using for years.
9. klaff · 1790961842 · focus · HN ↗

   Who is writing these executive orders?
10. aiXis · 1791118984 · focus · HN ↗

    [dead]

Unofficial Hacker News client; not affiliated with Y Combinator.