randy_nasson

Director of Product Management for Customer Identity Cloud (formerly Auth0) in our Identity and Access Management (IAM) domain. I joined Auth0 in 2018 and assembled a world-class IAM product team dedicated to delivering customer value and enabling developers to quickly implement secure, robust, and seamless identity solutions. In addition to my current work with CIC, I regularly work with our Auth0 Lab team on greenfield initiatives and with our Strategic and Technical Partner teams on opportunities to drive revenue.

Director, Product Management (IAM)

Randy Nasson

Long-lived sessions can improve user experience and reduce password reset costs.



**How long should a customer stay logged in to an application?** The [Open Web Application Security Project (OWASP)](https://auth0.com/blog/a-run-through-the-owasp-top-10/) and the [National Institute of Standards and Technology (NIST)](https://auth0.com/blog/what-the-new-nist-guidelines-mean-for-authentication/) state that it's safer for customers to sign in to your app for mere minutes. Limiting your customers to hold short sessions may leave them frustrated and unwilling to come back to use your application. A pillar of customer retention is to provide both a user-friendly and secure user experience. However, balancing those two user experience components is a real challenge for most businesses.

OWASP recommends application builders to implement **short idle time outs (2-5 minutes) for applications that handle [high-risk](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Session_Management_Cheat_Sheet.md) data**, like financial information. It considers that longer idle time outs (15-30 minutes) are acceptable for low-risk applications.

On the other hand, [NIST](https://pages.nist.gov/800-63-3/sp800-63b.html) recommends that application builders make their users **re-authenticate every 12 hours** and **terminate sessions after 30 minutes of inactivity**. For intermittent re-authentication, that session termination time shrinks to 2 minutes.

These guidelines by OWASP and NIST provide an ideal foundation to implement session security in applications. However, before you choose to extend your application's session length, it's also ideal for your team and your internal stakeholders to discuss how such a decision can impact your application's user experience.

Ultimately, [balancing security and user experience](https://abacuscambridge.com/blog/why-iam-perfect-blend-security-and-customer-experience) is key to achieve customer retention. A tedious authentication process can exhaust your customers and discourage them from using your application. A seamless, perhaps even invisible, authentication process can instead encourage your users to spend more time with your application _securely_.

Auth0 offers you a feature called long-lived sessions to offset the cost of implementing a secure user experience around authentication.

<include src="TweetQuote" quoteText="UX can help you keep or lose a customer. Balance #UX and #security with Auth0 long-lived sessions."/>

## Why Customers (And Businesses) Want Long-Lived Sessions

One of the conveniences of email services like Gmail is that you can check your email sporadically without having to face repetitive login prompts. Imagine how tedious it would be if you had to log in every time that you go idle for more than two minutes.

For media companies, like [Alma Media](https://auth0.com/learn/alma-media-sees-30-total-savings-seamless-brand-access/), customers may visit their site infrequently. Registered users often visit media sites every two weeks to consume content. Returning users who face the hassle of signing back in may opt to stop visiting the site. **For a media company, losing its audience means losing ad revenue, since clicks generate payments on ads.** If the revenue strategy also involves targeted advertising, media companies require a security strategy that favors maximum engagement with minimal friction.

If a company offers an essential service, its users may not have the option to leave the site. However, they may still become vocal about their dissatisfaction with the user experience on social media or review channels.

For example, a utility company may have monthly or quarterly billing cycles where end-users access its application to pay their bills. Other companies like [Autotrader](https://auth0.com/learn/coxs-autotrader-launches-premium-experience-auth0/) have customers with usage patterns that vary widely based on purchase and maintenance cycles. For any application with long periods between end-user engagement, users understandably forget their passwords.

Some Auth0 customers have reported that as much as **22% of their customers forget their passwords each quarter**. Frustrated customers have to contact call center staff to request password resets. Forgotten passwords may lead to decreased customer satisfaction, paired with increased business operation costs.

For low-risk engagements, you can provide better user experience by implementing a longer session limit, which could become the difference between keeping or losing a customer. While Auth0 focuses on making your applications more secure, we also understand the substantial value of your end-user experience.

Everything considered, long-lived sessions work exceptionally well for organizations with periodic or even intermittent engagement cycles.

Poor user experience can lead to customer dissatisfaction. Insufficient security can amount to legal penalties, fines, and losing customer trust. **The combination of poor user experience and insufficient security can compound into a catastrophic punch to damage a brand**.

## 100 Days Inactivity/365 Days Total Timeout

Auth0 lets you customize session lengths to fit the security risk tolerance of your desired user experience. You can configure session limits with up to 100 days of inactivity (idle timeout) and up to one year in total duration (absolute timeout). 

> The motivation behind the 100-day idle timeout cap is to cover one quarter plus a few days, which provides wiggle room for people who log in to do end-of-quarter reports.

Long-lived sessions allow companies with quarterly, monthly, or other types of customer engagement cycles to reduce friction for end-users and provide secure access to low-risk content and functionality.

Whenever your customers need to perform high-risk actions, such as changing account details or updating payment methods, you can rely on Auth0 functionality to programmatically require password validation to run those actions as an added layer of security.

![Auth0 Long-Lived Sessions - New Session Limits 100 Days/365 Days total timeout chart](https://images.ctfassets.net/23aumh6u8s0i/7tmP5QwFpRVgPVuZsYhcp0/f383df39269f7cd6b732315bc4542a28/auth0-long-lived-sessions-new-session-limits)

With Auth0's long-lived sessions, session management, and Single-Sign On (SSO), you can build a better user experience for returning customers, enable personalized targeting, and reduce the costs of operations by mitigating password resets. **If you'd like to learn more about how you can customize Auth0's out-of-the-box features to fit your needs, please reach out to <sales@auth0.com>**.


Balance User Experience and Security to Retain Customers

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

To stay competitive, media companies have to deliver seamless experiences built around customer identity. The race starts at login.



Today’s media consumers enjoy an incredible array of content and have an unprecedented number of choices for how, when, and where to consume it. In this saturated environment, media heads of product are engaged in a war for consumer attention. The winners are the companies that curate the most relevant content for each user, with simple, intuitive platforms that keep them coming back for more.

The media companies that are most successful at keeping consumer attention are those with the most intensive surgical focus on creating a personalized user experience. Netflix, for instance, doesn’t merely use its insights to recommend shows; they even tailor the [thumbnail images](https://www.vox.com/2018/11/21/18106394/why-your-netflix-thumbnail-coverart-changes) of those shows to different demographics and what they find most irresistible. Achieving this level of personalization requires media outlets to possess a deep and holistic understanding of each customer, not one that is fragmented across channels or devices.

In this piece, we’ll explore how uniting customer identity in a single view will enable UX that caters directly to your customers’ preferences. Building UX around identity is crucial for heads of production who want to make their platforms stand out rather than be one more dish in the endless media smorgasbord.

## Simplify Authentication Across Devices

The era of the internet of things (IoT) presents exciting possibilities for both media producers and consumers as more smart devices become capable of delivering content. But the promise of seamless, nearly effortless device usage is often stymied at the login screen.

As anyone who has tried to type their email address with a TV remote can attest, there are few UX experiences more painful than attempting to log in with a device that was never intended for entering credentials. This frustration and its cost to UX are avoidable if you implement [single sign-on (SSO)](https://auth0.com/blog/implementing-single-sign-on-in-b2c-applications/). With SSO, when users log in to an application with one set of credentials, they are automatically signed into other applications. The primary UX benefit of this is that it simplifies authentication across devices and accelerates the time to first login.

<include src="TweetQuote" quoteText="The era of the internet of things (IoT) presents exciting possibilities for both media producers and consumers as more smart devices become capable of delivering content."/>

With a sophisticated customer identity and access management (CIAM) solution like Auth0, you can use SSO to shift the login process to other devices, which are more user-friendly and are already associated with user profiles.

![Login Process](https://images.ctfassets.net/23aumh6u8s0i/01aER9PsXDQQNimIMoPUdF/4b03aa9398019f303bd1a13e1955ec2f/login-process)

Using [OAuth Device Flow](https://auth0.com/blog/oauth-device-flow-no-hassle-authentication-as-seen-on-tv/), a user trying to log in to your app via their smart TV won’t have to fiddle with their remote. Instead, they’ll be directed to visit a URL on their computer or smartphone, enter a short code, and complete the authentication process with far less friction. Aside from ease of use, shifting authentication to a browser also improves security, since users don’t have to directly expose their credentials to their smart devices.

## Reduce the Number of Required Logins

The login box is your first impression with a customer. At best, a time-consuming login means that customers begin their session with an unpleasant experience. At worst, it means they browse without logging in, robbing you of the chance to present them with personalized content. The solutions to this issue hinge on using your view of the customer to minimize the number of times they have to re-enter their credentials.

For multi-brand media companies, a seamless customer experience starts with SSO. For example, we’re all familiar with SSO when we log in to Google and are automatically logged in to YouTube. That feature is critical in enabling YouTube to recognize users and recommend videos tailored to their interests.

<include src="TweetQuote" quoteText="The login box is your first impression with a customer. At best, a time-consuming login means that customers begin their session with an unpleasant experience."/>

Another effective tactic to reduce tedious logins is implementing [long-lived sessions](https://auth0.com/blog/when-ux-equals-keeping-or-losing-the-customer/) for users. Long-lived sessions let developers extend the login period before idle time-outs, in which users are automatically logged out after a certain period of inactivity. Whereas maintaining a brief window for idle time-outs makes sense for apps that handle highly sensitive information, it often hurts media companies. If you have a user who typically logs on once a month to read new content, forcing them to log in each time harms UX without providing any real benefit.

![Long-Lived Sessions Diagram](https://images.ctfassets.net/23aumh6u8s0i/7mEOMklyIKITdeeLKYnAYw/c6c49224407e2e7fb40afe1595e156c9/long-lived-sessions)

If you choose to explore long-lived sessions, it’s crucial to have a CIAM provider like Auth0 that lets you tailor the system to your business. Auth0 lets you customize session limits of up to 100 days, which you can adjust based on the level of risk your business is comfortable with. You can also apply rules that require users to authenticate when engaging in activities such as changing payment details. It’s crucial to maintain this level of customization with long-lived sessions; otherwise, your short-term UX gains can be erased by compromised security.

## Create a Consistent Experience with an Identity Directory

In a media ecosystem that is often overwhelming to users, the ideal UX is a place where one’s needs are understood and catered to the moment one logs in. To achieve this uniform, curated experience across platforms, consider storing user profiles on a centralized directory.

It’s vital to have rich, holistic profiles that function as the authoritative source of truth about your customer. That way, even if a user logs in via social media at one point, and email the next, both logins still feed into a single profile. With this approach, profiles and content recommendations stay relevant even as login behaviors evolve.

Having a single profile — as opposed to duplicates across login methods or devices — ensures that your company’s advertising and marketing efforts are appropriate rather than intrusive. Lacking this alignment can have a negative effect on UX; [a recent study](https://www.marketingcharts.com/customer-centric/privacy-and-security-107946) found that 66% of consumers disliked being targeted too many times, and 44% were annoyed if targeted for too long.

Auth0 offers customers the ability to host their directories on their own servers or on the secure Auth0 server. If your needs change, you can [move your directory to Auth0](https://auth0.com/blog/the-three-best-ways-to-create-the-single-vision-of-a-customer/) without requiring that customers undergo a disruptive password reset. This model lets you scale, which results in consistent delivery of good UX even as you grow.

## Use Identity to Become a Content Concierge

In this crowded media landscape, compelling content is no longer enough to attract and retain customers. Consumers increasingly demand that companies not only select the most relevant and valuable content for them but also deliver it across all their devices with minimal effort.

Understanding your users’ identity is at the core of great UX. That’s why attaining a single vision of the customer is such an effective digital initiative for media heads of product. To do this project justice, be sure to partner with a CIAM that can provide an experience as simple, yet as customizable, as the one you offer your customers. If you’d like to learn more about how Auth0 can help you quickly create a CIAM solution that suits your needs, please reach out to an [Auth0 resource](mailto: sales@auth0.com).

<include src="asides/AboutAuth0" />

---


"long-lived sessions"