full-disclosure - Paper: Weaning the Web off of Session Cookies

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 26 Jan 2010 11:05:09 -0800
From: "Timothy D\. Morgan" <tmorgan@...curity.com>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk,
	webappsec@...ts.owasp.org
Subject: Paper: Weaning the Web off of Session Cookies

Hello,

I've just posted a new paper some of you may be interested in:
  http://www.vsecurity.com/download/papers/WeaningTheWebOffOfSessionCookies.pdf  

While it's primarily an argument for fixing HTTP authentication, it
does contain information on a few weaknesses common in browsers,
including password manager issues and user interface vulnerabilities.

Feedback is more than welcome.

Enjoy,
tim

Abstract
========
In this paper, we compare the security weaknesses and usability
limitations of both cookie-based session management and HTTP digest
authentication; demonstrating how digest authentication is clearly the
more secure system in practice.  We propose several small changes in
browser behavior and HTTP standards that will make HTTP authentication
schemes, such as digest authentication, a viable option in future
application development.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/