• 7heo@lemmy.ml
    592·
    1 year ago

    Server side sessions are still valid until you signal to the server to invalidate (destroy) them.

    That’s why “signing off” isn’t remotely the same as deleting cookies, and that’s why jwt are fundamentally a bad idea, especially without expiration.

    This meme is wrong. It’s the logical equivalent to saying that “extinguishing a fire” and “closing your eyes” are the same thing (as it makes the fire disappear to you), but that closing your eyes is just more convenient.

    • Daniel@lemmy.mlOPEnglish
      173·
      1 year ago

      Fair point, I made the meme to be silly, and, yes, this is one of the many reasons why tokens in general should expire after some point in time.

      Also the meme isn’t wrong, memes don’t need logic, they’re supposed to give people a giggle.

      • 7heo@lemmy.ml
        92·
        1 year ago

        Well yes, it does make people giggle, but memes are a serious form of communication now, they are used a lot, and are even used in psyops.

        So, making a meme that spreads misinformation in 2023 is among the most efficient ways to do so, especially if it does so implicitly and insidiously (by establishing two nonequivalent propositions as “equivalent” in the premise, like here).

        And, so, in that context, I argue that it is wrong, and I might add, harmful. It’s nothing against you personally or your “memeability”. It just reinforces the idea of a falsehood that undoes user education infosec professionals have been pushing for years.

        • Daniel@lemmy.mlOPEnglish
          33·
          1 year ago

          To be Frank, who I am not (I’m Hai), I can’t tell if you’re a troll or not. Although, if you’re not, my meme is not “wrong” or spreading misinformation it contains a logical fallacy, as many jokes do. I can list jokes that contain logical fallacies upon request.

          • 7heo@lemmy.ml
            61·
            1 year ago

            Bruh, pointing out that “you’re spreading out misinformation as a joke” isn’t trolling. I’d recommend going out to touch grass, but given how thin your skin is, I am afraid you’re at aggravated risks of third degree burns from the slightest sun exposure, even during a cloudy day. So I’ll recommend for you to wear a thick coat and go see a dermatologist instead.

            P.S.: nice pun, I loled.

            • Daniel@lemmy.mlOPEnglish
              2·
              1 year ago

              This was the funniest thing I read all day, thank you. Sorry for misunderstanding your tone.

    • NightAuthor@lemmy.worldEnglish
      9·
      1 year ago

      Look at this guy over here, nerding out about the WiFi.

      Jk, glad to find someone in the comments correcting the misinformation in the meme. OP is probably a hacker who likes to do session hijacking.

    • redcalcium@lemmy.institute
      5·
      1 year ago

      JWT sounds great on paper until you have to deal with logout and revocations. Might as well use standard session cookies.

      • 7heo@lemmy.ml
        4·
        1 year ago

        It is a great idea, but like most implementations using cryptography in new applications with novel concepts (like cryptocurrencies), it’s half assed, and people are so eager to release and use it that they forego any simulation, testing and staging of their design; so we only get to find about any shortcomings, inefficiencies, or even design mistakes, once said tech has become big and popular (and consequently, a pain to fix and patch).

      • 7heo@lemmy.ml
        3·
        1 year ago

        If the cookie was saved in any way (maliciously or not: session hijacking, restored backup, etc), they are logged in. That’s exactly the problem, thanks for pointing it out.

        If they had “logged off” (or closed the session), no amount of cookie resurrection would log them back in: the server would refuse that cookie session the same way it would refuse an expired password.

          • 7heo@lemmy.ml
            1·
            1 year ago

            Depends on your (actually, their, for example if it implies ephemeral server sessions) definition of “incognito”. But if you mean “incognito” as in “private browsing”, it makes no difference (as it has no server side impact whatsoever).

            A file is a file, a remote database entry is a remote database entry. You need both gone (and securely deleted, as in srm(1), to be really and irredeemably logged off).

            Admittedly, secure deletion doesn’t really matter on the server side, as restoring deleted files require filesystem level access on the server, and if an attacker has that, you’ve got other things to worry about.

            • SnipingNinja@slrpnk.net
              2·
              1 year ago

              Yeah, that’s what I was curious about, the security issues you mentioned as I wasn’t clear in my understanding until now. Thanks.

          • 7heo@lemmy.ml
            4·
            1 year ago

            Yeah, so lemme show you a few tools since we’re on the topic of sharing.

            1. Find the tool that tickles your fancy here or here.
            2. Find a target (for this part I won’t be giving any links).
            3. Once you have access to your target, run your file recovery tool (winfr, testdisk, etc).
            4. Bring back any and all cookies.
            5. Exfiltrate them using twitter, github, email, whatever.
            6. Congratulations, you now have access to all the (not yet expired) sessions (i.e. accounts) your target ever used, because they follow(ed) the recommendations in the meme of OP and in your comment.

            Please log out from apps and websites!

    • 4am@lemm.eeEnglish
      1·
      1 year ago

      Yeah you really should do both. Some session cookies can just be used as tracking cookies later.

      • 7heo@lemmy.ml
        1·
        1 year ago

        Just start with closing the session, eh? Otherwise the app won’t know what session to close.

        And hopefully when the session is destroyed on the server, the app also deletes the client cookie. Assuming there will never be any server bugs, so that keeping the previous SessionIDs around on the client is “no problem”, sounds like your average “famous last words” occurrence.

  • mle@feddit.de
    33·
    1 year ago

    Automatically clear cookies on browser exit, only whitelist the couple of websites you use regularly.

    Has the added benefit of making tracking cookies fairly (but not completely) useless

      • archchan@lemmy.ml
        5·
        1 year ago

        That’s still good practice but first party cookies aren’t exactly trustworthy either. IMO, best to whitelist what you trust and use, permablock what you don’t, and auto-wipe the rest.

          • Daniel@lemmy.mlOPEnglish
            2·
            1 year ago

            Cookies used by the site, third party would be cross origin.

            (I think)

              • 0xD@infosec.pub
                2·
                1 year ago

                To be precise, first-party and third-party just means whether the cookie set is for the domain you are currently on, or for another one. The latter do not have to be tracking cookies, but are often used as such. You can see the cookies that your browser is storing for a specific site by visiting it and looking at them in the developer tools (Storage or Application tab, depending on browser). Under the “domain” column you can see what domain it is for.

                Furthermore, there you can look at the Local Storage and Session Storage tables which are also often used to store tracking data but are not prevented by cookie deletion.

  • Izzy@lemmy.ml
    121·
    1 year ago

    Only ever using private windows and then alt F4ing to automatically delete all session data.

    • ShustOne@lemmy.one
      7·
      1 year ago

      These days you’ll need to clear localStorage, sessionStorage, and localDb to really do this. The rise in tokens means some sites only use those.