RE: Login credentials and session id security

["Abhishek Kumar" <abhishek.kumar () paladion net>]

Hi Vishal,

Following are my responses to your query,

What is the most secure method of sending the login credentials to the
server? The answer is "POST" method, as anything sent using POST is not
cached in the browser's history. On the other hand values sent using GET can
be seen in the links which are cached in browser's history. 

How should the login credentials be encrypted so that they are not
compromised? Well SSL achieves the encryption requirements of entire http
data. However as you mentioned, the login credentials can be captured using
a web proxy or even through the system memory. Here is a paper which talks
about memory exploits
(http://paladion.net/pdf/Discovering_Passwords_In_Memory.pdf). So the best
way to encrypt and send login credentials is to use "Salted Hash" technique.
You can read the details salted hash here
(http://plynt.com/blog/2005/07/searching-memory-for-secrets-w/) and here
(http://www.aspheute.com/english/20040105.asp).

Regarding session management, there are many security aspects to be looked
into. I may not be able to cover all here, but would recommend you to go
through the following paper for detailed information
(http://www.sans.org/reading_room/whitepapers/webservers/1594.php).

Thanks
Abhishek


-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On
Behalf Of Vishal Garg
Sent: Wednesday, June 06, 2007 3:12 PM
To: webappsec () securityfocus com
Subject: Login credentials and session id security

Hi All,

Can someone please tell what is the most secure way of sending login 
credentials to the server. The possible ways that I am familiar with are:

- get method
- post method
- hidden form fields

By using an encrypted connection we cannot sniff the credentials, but 
still it is very easy to capture or manipulate these credentials 
using a web proxy from any of these methods. So I am looking to find 
a method to transport the credentials to the server so that the 
security of these credentials can't be compromised even by deploying 
a web proxy.

Also once a session id is generated, what is the best way to maintain 
the security of a session id.

Any help would be much appreciated.

Regards
Vishal


-------------------------------------------------------------------------
Sponsored by: Watchfire

The Twelve Most Common Application-level Hack Attacks
Hackers continue to add billions to the cost of doing business online 
despite security executives' efforts to prevent malicious attacks. This 
whitepaper identifies the most common methods of attacks that we have seen, 
and outlines a guideline for developing secure web applications. 
Download today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe
--------------------------------------------------------------------------


-------------------------------------------------------------------------
Sponsored by: Watchfire

The Twelve Most Common Application-level Hack Attacks
Hackers continue to add billions to the cost of doing business online 
despite security executives' efforts to prevent malicious attacks. This 
whitepaper identifies the most common methods of attacks that we have seen, 
and outlines a guideline for developing secure web applications. 
Download today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe
--------------------------------------------------------------------------