WebApp Sec mailing list archives
Re: Cookies as the second factor
From: Rogan Dawes <discard () dawes za net>
Date: Tue, 18 Jul 2006 16:47:18 +0200
Jeff Robertson wrote:
It seems like it's been mentioned on here before, that a number of "two factor" or "multi factor" authentication schemes actually use a cookie as the second factor. Anyone here have specific experience with such solutions, or opinions about how much security they add to a system?
Sounds completely bogus to me.The cookie is typically generated by the server, as a response to an authentication event (single or multi-factor). The cookie is then used to maintain that authentication from request to request.
There is NO authentication component in such a cookie. It is created by the SERVER, and as such CANNOT qualify as an authentication factor at all.
Rogan ------------------------------------------------------------------------- Sponsored by: WatchfireAppScan 6.5 is now available! New features for Web Services Testing, Advanced Automated Capabilities for Penetration Testers, PCI Compliance Reporting, Token Analysis, Authentication testing, Automated JavaScript execution and much more. Download a Free Trial of AppScan today!
https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc -------------------------------------------------------------------------
Current thread:
- Cookies as the second factor Jeff Robertson (Jul 18)
- Re: Cookies as the second factor Rogan Dawes (Jul 18)
- Re: Cookies as the second factor Robin Wood (Jul 18)
- Re: Cookies as the second factor Rogan Dawes (Jul 18)
- RE: Cookies as the second factor Matt Fisher (Jul 18)
- Re: Cookies as the second factor Andrew van der Stock (Jul 18)
- RE: Cookies as the second factor Randy Ollett (Jul 18)
- RE: Cookies as the second factor Andrew Chong (Jul 18)
- RE: Cookies as the second factor Ken Kousky (Jul 18)
- Re: Cookies as the second factor Robin Wood (Jul 18)
- Re: Cookies as the second factor Rogan Dawes (Jul 18)
- Re: Cookies as the second factor Ryan Barnett (Jul 18)
- RE: Cookies as the second factor Jeff Robertson (Jul 18)
- RE: Cookies as the second factor Matt Fisher (Jul 18)