WebApp Sec mailing list archives
RE: Cookies as the second factor
From: "Ken Kousky" <kkousky () ip3inc com>
Date: Tue, 18 Jul 2006 19:45:29 -0400
Sometimes these posts sound like their for the author rather than the reader, but with that said, if there are still issues here lets return to the basics --- Any factor is stronger if it can't easily be reproduced and if we know when it's missing .. in this regard, there are endless algorithms that can generate a value from a machine to be used as an authentication factor. We could check out a machines mac address and look at other system features to generate a unique value or we could deposit a cookie. They're both examples of TOKENS, something we have, In general, they can be augmented by a pin number, which is something we know and we're at least at the 1+ factor level. The strength of the factor though is how exposed it is: 1) how easily discovered it is 2) can it be cloned or copied 3) do we know if it's been compromised 4) how quickly are we aware of it's being compromised 5) can we lock out brute force attacks or can they be done off-line as in dictionary attacks on our password hashes As FFIEC pushes online financial services to explore more robust authentication, we can expect to see a far more serious discussion of these issues. In the mean time, we continue to advise: 1) get rid of strong passwords, they're an oxymoron 2) you can have a strong string you write down and then append a simple pin and have one and a half factors but you're way ahead of strong passwords which must be written down to be operationally functional Ken Kousky IP3 -----Original Message----- From: Andrew Chong [mailto:andrewjw () singnet com sg] Sent: Tuesday, July 18, 2006 1:19 PM To: 'Robin Wood'; discard () dawes za net Cc: 'Jeff Robertson'; webappsec () securityfocus com Subject: RE: Cookies as the second factor I guess the question put forward is how to achieve 2 factor authentication. The best way is to use a token based device (what you have). A good recommendation is the Crypto Card which looks like a calculator. It cost about USD$95 each. If Crypto Card is too expensive, then you can implement a one-time challeng PIN authentication to the user registered email. When a user login correctly, a email containing a one-time PIN will be send to the user registered email address. Once the email is receive, the user can entered the PIN on the website again to login. Regards, Andrew Chong (Singapore), CISSP. -----Original Message----- From: Robin Wood [mailto:dninja () gmail com] Sent: Tuesday, July 18, 2006 11:03 PM To: discard () dawes za net Cc: Jeff Robertson; webappsec () securityfocus com Subject: Re: Cookies as the second factor Javascript could be used to generate the cookie which is then passed back to the server with each request. This would save having to make sure a value was posted or passed on the query string on each request. Don't have time to think about how good this would be for authentication but I think techincally it can be done. Robin On 7/18/06, Rogan Dawes <discard () dawes za net> wrote:
Jeff Robertson wrote:It seems like it's been mentioned on here before, that a number of "two factor" or "multi factor" authentication schemes actually use a
cookie as the second factor. Anyone here have specific experience with such solutions, or opinions about how much security they add to a system?Sounds completely bogus to me. The cookie is typically generated by the server, as a response to an authentication event (single or multi-factor). The cookie is then used
to maintain that authentication from request to request. There is NO authentication component in such a cookie. It is created by the SERVER, and as such CANNOT qualify as an authentication factor at all. Rogan ---------------------------------------------------------------------- --- Sponsored by: Watchfire AppScan 6.5 is now available! New features for Web Services Testing, Advanced Automated Capabilities for Penetration Testers, PCI Compliance Reporting, Token Analysis, Authentication testing, Automated JavaScript execution and much more. Download a Free Trial of
AppScan today! https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CY kc
------------------------------------------------------------------------ -
------------------------------------------------------------------------ - Sponsored by: Watchfire AppScan 6.5 is now available! New features for Web Services Testing, Advanced Automated Capabilities for Penetration Testers, PCI Compliance Reporting, Token Analysis, Authentication testing, Automated JavaScript execution and much more. Download a Free Trial of AppScan today! https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc ------------------------------------------------------------------------ - -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.394 / Virus Database: 268.10.1/390 - Release Date: 7/17/2006 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.394 / Virus Database: 268.10.1/391 - Release Date: 7/18/2006 ------------------------------------------------------------------------- Sponsored by: Watchfire AppScan 6.5 is now available! New features for Web Services Testing, Advanced Automated Capabilities for Penetration Testers, PCI Compliance Reporting, Token Analysis, Authentication testing, Automated JavaScript execution and much more. Download a Free Trial of AppScan today! https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc ------------------------------------------------------------------------- ------------------------------------------------------------------------- Sponsored by: Watchfire AppScan 6.5 is now available! New features for Web Services Testing, Advanced Automated Capabilities for Penetration Testers, PCI Compliance Reporting, Token Analysis, Authentication testing, Automated JavaScript execution and much more. Download a Free Trial of AppScan today! https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc -------------------------------------------------------------------------
Current thread:
- Cookies as the second factor Jeff Robertson (Jul 18)
- Re: Cookies as the second factor Rogan Dawes (Jul 18)
- Re: Cookies as the second factor Robin Wood (Jul 18)
- Re: Cookies as the second factor Rogan Dawes (Jul 18)
- RE: Cookies as the second factor Matt Fisher (Jul 18)
- Re: Cookies as the second factor Andrew van der Stock (Jul 18)
- RE: Cookies as the second factor Randy Ollett (Jul 18)
- RE: Cookies as the second factor Andrew Chong (Jul 18)
- RE: Cookies as the second factor Ken Kousky (Jul 18)
- Re: Cookies as the second factor Robin Wood (Jul 18)
- Re: Cookies as the second factor Rogan Dawes (Jul 18)
- Re: Cookies as the second factor Ryan Barnett (Jul 18)
- RE: Cookies as the second factor Jeff Robertson (Jul 18)
- RE: Cookies as the second factor Matt Fisher (Jul 18)
- Re: Cookies as the second factor mikeiscool (Jul 18)
- Re: Cookies as the second factor Darren Bounds (Jul 18)
- RE: Cookies as the second factor Jeff Robertson (Jul 20)