Re: Login credentials and session id security

[matt farey <matt.farey () gmail com>]

Some large corporations import and pre-trust client certificates on
their LAN PCs so that IE won't give a warning to the user where the SSL
tunnel was terminated and restarted on the gateway/proxy. You cannot
overcome this unless you use a further symmetric method (say javascript)
that would allow a payload (of encrypted data) to be sent encrypted over
SSL, the user-agent would then accept a password and decrypt and display
the payload, this isn't really practical though, in this case MITM
attacks cannot really be prevented, you are at the mercy of the
companies IT policies - which might infringe privacy legislation (if
there is any). Could you use terms and conditions on your website to
make the storage and/or use of any data gathered by the company proxy an
illegal act by the corporation? my $0.02
matt


Vishal Garg wrote:
> Hi,
>
> Thanks Rogan and everyone else for replying to my query and the
> responses were quite helpful. Ok, here I'll give one scenario to make
> it even more clear if someone could not understand my point correctly.
>
> Suppose this is an e-commerce application and a user is trying to
> access it through some shared computer such a Internet cafe or a
> hotel. Now my worry is that it is possible to capture user credentials
> by deploying a web proxy client, no matter the application is using
> GET or POST methods or is using an encrypted session. Yes, user would
> get an SSL error message but only in Firefox as I have not seen such
> message appearing in IE yet (I'm using IE6).
>
> From the responses till now, it appears to me that using salted hashes
> of passwords is the best way as it would not appear as plain text in
> web proxy. Also server generates a new hash using a new salt every
> time a user wants to authenticate to avoid replay attacks.
>
> Any other thoughts or suggestions would be much appreciated.
>
> Regards
> Vishal
>
>
> At 10:56 6/7/2007, Rogan Dawes wrote:
> > Vishal Garg wrote:
> > > Hi All,
> > > Can someone please tell what is the most secure way of sending login
> > > credentials to the server. The possible ways that I am familiar with
> > > are:
> > > - get method
> > > - post method
> >
> > These are HTTP methods for sending parameters.
> >
> > > - hidden form fields
> >
> > This is a technique for defining parameters which will result in one
> > or other of the GET or POST methods (above) being executed.
> >
> > > By using an encrypted connection we cannot sniff the credentials,
> > > but still it is very easy to capture or manipulate these credentials
> > > using a web proxy from any of these methods. So I am looking to find
> > > a method to transport the credentials to the server so that the
> > > security of these credentials can't be compromised even by deploying
> > > a web proxy.
> >
> > The proxy can only be used by someone who accepts the certificate
> > validation error that appears in the browser. If you are worried that
> > your users might be trying to subvert your login process, the odds
> > are good that you are trying to make your login process too complex!
> >
> > In the normal event, your users will know their username and
> > password, so trying to prevent them from intercepting these same
> > values is completely pointless. If your concern is regarding
> > cleartext passwords being available on the server (e.g. you don't
> > ever want clear text passwords to leave the browser), you may want to
> > consider something like  Secure Remote Password (SRP). However, this
> > requires a Java applet or ActiveX control for performing the crypto
> > and generating random numbers, and is unlikely to be popular.
> >
> > > Also once a session id is generated, what is the best way to
> > > maintain the security of a session id.
> >
> > See http://www.owasp.org/index.php/Session_Management
> > > Any help would be much appreciated.
> > > Regards
> > > Vishal
> >
> > Hope this helps.
> >
> > Rogan
>
>
>
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
>
> The Twelve Most Common Application-level Hack Attacks
> Hackers continue to add billions to the cost of doing business online
> despite security executives' efforts to prevent malicious attacks.
> This whitepaper identifies the most common methods of attacks that we
> have seen, and outlines a guideline for developing secure web
> applications. Download today!
>
> https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe
> --------------------------------------------------------------------------

-- 
Matthew Farey
Web App Sec.
25 The Polygon, Southampton, SO15 2BP, UK
+44(0)2380 631449



-------------------------------------------------------------------------
Sponsored by: Watchfire

The Twelve Most Common Application-level Hack Attacks
Hackers continue to add billions to the cost of doing business online 
despite security executives' efforts to prevent malicious attacks. This 
whitepaper identifies the most common methods of attacks that we have seen, 
and outlines a guideline for developing secure web applications. 
Download today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe
--------------------------------------------------------------------------