lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 28 Jan 2010 14:03:57 -0800
From: James Landis <jcl24@...nell.edu>
To: "Timothy D. Morgan" <tmorgan@...curity.com>
Cc: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk,
	webappsec@...ts.owasp.org
Subject: Re: [Webappsec] Paper: Weaning the Web off of Session Cookies

Tim,
Great writeup of the state of the union for Web-based authentication methods.

As you mention, your paper is primarily an argument for fixing HTTP
auth. That might make a better title for it, in fact, since that does
seem to be the primary thrust of the arguments presented. Or at least,
"If We Wean the Web Off of Session Cookies, This Is Some of What We'd
Have to do". I wasn't convinced at all that Weaning the Web Off of
Session Cookies was the logical conclusion of the data you presented.

To solve problems with forms-based auth + session tokens, we only have
to fix some things in Web app frameworks, many of which have already
been fixed in major platforms. Predictable session identifiers, for
instance, pretty much died out years ago. To migrate to HTTP Digest
Auth, not only would we have to fix a few things in Web app
frameworks, we'd have to refactor a massive amount of custom code AND
convince all major browser vendors all to do the same right things and
THEN force everyone to update their UA to the latest version.

I'm not sure you've identified the path of least resistance! :)

-j

On Tue, Jan 26, 2010 at 11:05 AM, Timothy D. Morgan
<tmorgan@...curity.com> wrote:
>
> Hello,
>
> I've just posted a new paper some of you may be interested in:
>  http://www.vsecurity.com/download/papers/WeaningTheWebOffOfSessionCookies.pdf
>
> While it's primarily an argument for fixing HTTP authentication, it
> does contain information on a few weaknesses common in browsers,
> including password manager issues and user interface vulnerabilities.
>
> Feedback is more than welcome.
>
> Enjoy,
> tim
>
>
> Abstract
> ========
> In this paper, we compare the security weaknesses and usability
> limitations of both cookie-based session management and HTTP digest
> authentication; demonstrating how digest authentication is clearly the
> more secure system in practice.  We propose several small changes in
> browser behavior and HTTP standards that will make HTTP authentication
> schemes, such as digest authentication, a viable option in future
> application development.
> _______________________________________________
> Webappsec mailing list
> Webappsec@...ts.owasp.org
> https://lists.owasp.org/mailman/listinfo/webappsec
>

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux - Powered by OpenVZ