WebApp Sec mailing list archives
RE: Cookies as the second factor
From: "Randy Ollett" <Randy.Ollett () ama-assn org>
Date: Tue, 18 Jul 2006 10:59:41 -0500
Jeff, I think you have it correct - cookies are used to maintain a relationship that could be established via connecting free and clear, single factor, or multi-factor. They are operational "mechanisms" helpful in maintaining a connection between two points. Two factor authentication refers to initial connection, where you require you use two of the following three "factors" - something you know, something you have or something you are. Cookies help maintain the connection. Thank you. Randy Ollett American Medical Association 312-464-4963 randy.ollett () ama-assn org -----Original Message----- From: Robin Wood [mailto:dninja () gmail com] Sent: Tuesday, July 18, 2006 10:03 AM To: discard () dawes za net Cc: Jeff Robertson; webappsec () securityfocus com Subject: Re: Cookies as the second factor Javascript could be used to generate the cookie which is then passed back to the server with each request. This would save having to make sure a value was posted or passed on the query string on each request. Don't have time to think about how good this would be for authentication but I think techincally it can be done. Robin On 7/18/06, Rogan Dawes <discard () dawes za net> wrote:
Jeff Robertson wrote:It seems like it's been mentioned on here before, that a number of
"two
factor" or "multi factor" authentication schemes actually use a
cookie
as the second factor. Anyone here have specific experience with such solutions, or
opinions
about how much security they add to a system?Sounds completely bogus to me. The cookie is typically generated by the server, as a response to an authentication event (single or multi-factor). The cookie is then used to maintain that authentication from request to request. There is NO authentication component in such a cookie. It is created
by
the SERVER, and as such CANNOT qualify as an authentication factor at
all.
Rogan
------------------------------------------------------------------------ -
Sponsored by: Watchfire AppScan 6.5 is now available! New features for Web Services Testing, Advanced Automated Capabilities for Penetration Testers, PCI
Compliance
Reporting, Token Analysis, Authentication testing, Automated
JavaScript
execution and much more. Download a Free Trial of AppScan today!
https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
------------------------------------------------------------------------ -
------------------------------------------------------------------------ - Sponsored by: Watchfire AppScan 6.5 is now available! New features for Web Services Testing, Advanced Automated Capabilities for Penetration Testers, PCI Compliance Reporting, Token Analysis, Authentication testing, Automated JavaScript execution and much more. Download a Free Trial of AppScan today! https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc ------------------------------------------------------------------------ - ------------------------------------------------------------------------- Sponsored by: Watchfire AppScan 6.5 is now available! New features for Web Services Testing, Advanced Automated Capabilities for Penetration Testers, PCI Compliance Reporting, Token Analysis, Authentication testing, Automated JavaScript execution and much more. Download a Free Trial of AppScan today! https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc -------------------------------------------------------------------------
Current thread:
- Cookies as the second factor Jeff Robertson (Jul 18)
- Re: Cookies as the second factor Rogan Dawes (Jul 18)
- Re: Cookies as the second factor Robin Wood (Jul 18)
- Re: Cookies as the second factor Rogan Dawes (Jul 18)
- RE: Cookies as the second factor Matt Fisher (Jul 18)
- Re: Cookies as the second factor Andrew van der Stock (Jul 18)
- RE: Cookies as the second factor Randy Ollett (Jul 18)
- RE: Cookies as the second factor Andrew Chong (Jul 18)
- RE: Cookies as the second factor Ken Kousky (Jul 18)
- Re: Cookies as the second factor Robin Wood (Jul 18)
- Re: Cookies as the second factor Rogan Dawes (Jul 18)
- Re: Cookies as the second factor Ryan Barnett (Jul 18)
- RE: Cookies as the second factor Jeff Robertson (Jul 18)
- RE: Cookies as the second factor Matt Fisher (Jul 18)
- Re: Cookies as the second factor mikeiscool (Jul 18)
- Re: Cookies as the second factor Darren Bounds (Jul 18)