Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have two online accounts from different banks, one bank expires my session faster than the other, it's quite annoying.

I was wondering how long (or short) should a session be for it to be considered safe enough but not annoying?

share|improve this question
    
The problem is there since interactive sessions exist, be it inirc or somewhere else. For a browser like Firefox, make your own rules with Greasemonkey or similar. You decide, when you logoff. Not some Mister AllKnow. –  ott-- Sep 16 '13 at 21:11

2 Answers 2

Generic answer: ideally, the session should be exactly as short as possible, the limit being, indeed, the user's annoyance.

You make sessions because the user would not accept to reenter his password for every single page request. A session is a deliberate, controlled weakening of your security model; you accept it because otherwise the site would be unusable. However, your interest, on the server, is to keep sessions short.

Now, of course, this is a trade-off. User's annoyance is not binary. A bank will balance their own feeling of security against their perception of the user's annoyance (and the importance thereof -- the bank knows that it can thoroughly abuse the user, since bank account owners are somewhat "captive"). Apparently, your two banks chose distinct compromises.

share|improve this answer

The following applies to sensitive sites (banks, government services, etc.)

  1. Get out of your room to the hallway.
  2. Grab anybody and make them sit in front of the computer.
  3. Ask them to use the service to perform some operations.
  4. Find how long that took.
  5. Multiply the time by 3. That's the minimum of how long your session needs to last.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.