what would be the correct timeout for logging out a session, vs lawyerised evolution of same

What is a good timeout for authenticated sessions including for online banking?  Around a working day.  Not 10 minutes.  Oh, never mind, I've written about this in "your session has expired: the sorry state of web session timeouts", and don't really have anything to add.

[0] <https://wibblement.blogspot.com/2021/12/your-session-has-expired-sorry-state-of.html>

Comments

Post a Comment

Popular posts from this blog

the persistent idiocy of "privileged ports" on Unix

TCP and UDP have ports.  These are 16 bit; there are 65535 or so per IP address. These protocols don't care to differentiate between the ports.  Elsewhere, IANA presumes to operate a process to allocate "well-known" ports in the range 1-1023, "registered ports" in the range 1024-49151, and to reserve the remainder, 49152–65535, for "ephemeral" ports.  The caller end has to have a port, which is how replies get back within the virtual connection, and these are conventionally picked from the ephemeral range by the OS's networking stack. The whole idea of ports is ridiculous, because it allows ISPs to arse around presuming to decide which services they will "not allow".  Anything that allows IPSs to do anything other than shift opaque packets will allow ISPs to meddle and break things, and due to the Law of Meddling, if they can, they will.  I am currently working around an issue with Claro, a pretend ISP, blocking port 5060, allocated to SI
Read more

easyjet: repeated entry of information they already have

Image
As I observed earlier today, airline web sites are obsessed with making people re-enter information, apparently arbitrarily. The following seems to be required for Easyjet, for an "existing" customer relationship, every time: country of residence selected from big list, involving skidding around on the screen that makes the victim feel sick should be remembered. If it has to be changed, should be type-and-choose victim is taunted with the text "tell us about you", when they thought they had logged in form with the following on one page: business / leisure title, first name, last name, age there is a button to "copy from contact details", but this doesn't do the "age" field.  Since they have my date of birth, they are of course able to calculate my age.  As well, the only values for this field are "18+", "17", or "16".  Is it a deliberate decision, to not fill this field based on the customer data, and to make the
Read more

Guernsey Waste in incorrect bag-rejection horror May 6th, 2024

Image
The rubbish collection folk at my new place seem pickier than at other places on Guernsey. Last week, they removed some card packaging that I'd included in the card and paper (plastic) clear bag, and left it on the lane.  This week, they have attached a rejection label entitled "Polite Notice".  Just like modern software-engineered error messages (see attached tag "extremely_general_error_handling"), this does not give a specific reason why the bag was rejected, but instead lists miscellaneous possible "reasons", leaving the victim guessing, or perhaps trying to follow a process of elimination. In this case, some possible reasons, which the label does not claim to be exhaustive ("was most likely because ..."), and of which none apply, are: (i) "did not have the required payment sticker" -- no, I applied to 90 litre sticker; or  (ii) (a) "too heavy" -- no, I estimate it was 3kg, and I easily supported the bag's weight o
Read more