Re: Cookies as the second factor

[mikeiscool <michaelslists () gmail com>]

On 7/19/06, Darren Bounds <dbounds () gmail com> wrote:
> There's no reason a cookie couldn't be generated client-side. I could
> easily have a client-side application generate a 'secure', one-time
> use token, populate a cookie and then use that value as one part of a
> multi-factor authentication scheme.

except that if your 'client' is compromised you are stuffed.

two factor should work even in a client-compromised situation.

-- mic

-------------------------------------------------------------------------
Sponsored by: Watchfire

AppScan 6.5 is now available! New features for Web Services Testing, 
Advanced Automated Capabilities for Penetration Testers, PCI Compliance 
Reporting, Token Analysis, Authentication testing, Automated JavaScript 
execution and much more. 
Download a Free Trial of AppScan today!

https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
-------------------------------------------------------------------------