Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two online accounts from different banks, one bank expires my session faster than the other, it's quite annoying.

I was wondering how long (or short) should a session be for it to be considered safe enough but not annoying?

share|improve this question
The problem is there since interactive sessions exist, be it inirc or somewhere else. For a browser like Firefox, make your own rules with Greasemonkey or similar. You decide, when you logoff. Not some Mister AllKnow. – ott-- Sep 16 '13 at 21:11
up vote 6 down vote accepted

Generic answer: ideally, the session should be exactly as short as possible, the limit being, indeed, the user's annoyance.

You make sessions because the user would not accept to reenter his password for every single page request. A session is a deliberate, controlled weakening of your security model; you accept it because otherwise the site would be unusable. However, your interest, on the server, is to keep sessions short.

Now, of course, this is a trade-off. User's annoyance is not binary. A bank will balance their own feeling of security against their perception of the user's annoyance (and the importance thereof -- the bank knows that it can thoroughly abuse the user, since bank account owners are somewhat "captive"). Apparently, your two banks chose distinct compromises.

share|improve this answer
okay good point but how long should it be for different scenarios for example? also perhaps it would be better to make a session as long 24/16/8/4/2/1 hours long as a thumb-rule. or even better keep the session alive when the user is not idle. – ColacX Jun 1 at 7:37

The following applies to sensitive sites (banks, government services, etc.)

  1. Get out of your room to the hallway.
  2. Grab anybody and make them sit in front of the computer.
  3. Ask them to use the service to perform some operations.
  4. Find how long that took.
  5. Multiply the time by 3. That's the minimum of how long your session needs to last.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.