Bugtraq mailing list archives
Re: [Webappsec] Paper: Weaning the Web off of Session Cookies
From: "Arian J. Evans" <arian.evans () anachronic com>
Date: Thu, 28 Jan 2010 14:51:59 -0800
Good points James. I read this paper a few times to make sure I got the point, and it's a cute idea but I just don't see it happening. For multi-node, multi-app, websites sharing auth/state/preferences across multiple web assets (physical servers and logical "websites") this is pretty much a non-starter. Cookies rule here. For a dozen different reasons that I can think of. Always good to try and raise the bar, but the world has voted cookies (thanks Lou!) and I think they are here to stay for at least the next decade. Oh, yeah, and marketing rules the world, and web sales and marketing (and Google) LOVE cookies. So that is what it is and I really don't see that changing until they can inject a tracking device into your body. --- Arian Evans capitalist marksman. eats animals. On Thu, Jan 28, 2010 at 2:03 PM, James Landis <jcl24 () cornell edu> wrote:
Tim, Great writeup of the state of the union for Web-based authentication methods. As you mention, your paper is primarily an argument for fixing HTTP auth. That might make a better title for it, in fact, since that does seem to be the primary thrust of the arguments presented. Or at least, "If We Wean the Web Off of Session Cookies, This Is Some of What We'd Have to do". I wasn't convinced at all that Weaning the Web Off of Session Cookies was the logical conclusion of the data you presented. To solve problems with forms-based auth + session tokens, we only have to fix some things in Web app frameworks, many of which have already been fixed in major platforms. Predictable session identifiers, for instance, pretty much died out years ago. To migrate to HTTP Digest Auth, not only would we have to fix a few things in Web app frameworks, we'd have to refactor a massive amount of custom code AND convince all major browser vendors all to do the same right things and THEN force everyone to update their UA to the latest version. I'm not sure you've identified the path of least resistance! :) -j On Tue, Jan 26, 2010 at 11:05 AM, Timothy D. Morgan <tmorgan () vsecurity com> wrote:Hello, I've just posted a new paper some of you may be interested in: http://www.vsecurity.com/download/papers/WeaningTheWebOffOfSessionCookies.pdf While it's primarily an argument for fixing HTTP authentication, it does contain information on a few weaknesses common in browsers, including password manager issues and user interface vulnerabilities. Feedback is more than welcome. Enjoy, tim Abstract ======== In this paper, we compare the security weaknesses and usability limitations of both cookie-based session management and HTTP digest authentication; demonstrating how digest authentication is clearly the more secure system in practice. We propose several small changes in browser behavior and HTTP standards that will make HTTP authentication schemes, such as digest authentication, a viable option in future application development. _______________________________________________ Webappsec mailing list Webappsec () lists owasp org https://lists.owasp.org/mailman/listinfo/webappsec_______________________________________________ Webappsec mailing list Webappsec () lists owasp org https://lists.owasp.org/mailman/listinfo/webappsec
Current thread:
- Paper: Weaning the Web off of Session Cookies Timothy D. Morgan (Jan 26)
- Re: [Webappsec] Paper: Weaning the Web off of Session Cookies James Landis (Jan 29)
- Re: [Webappsec] Paper: Weaning the Web off of Session Cookies Arian J. Evans (Jan 29)
- Re: [Webappsec] Paper: Weaning the Web off of Session Cookies James Landis (Jan 29)