Full Disclosure mailing list archives
Paper: Weaning the Web off of Session Cookies
From: "Timothy D\. Morgan" <tmorgan () vsecurity com>
Date: Tue, 26 Jan 2010 11:05:09 -0800
Hello, I've just posted a new paper some of you may be interested in: http://www.vsecurity.com/download/papers/WeaningTheWebOffOfSessionCookies.pdf While it's primarily an argument for fixing HTTP authentication, it does contain information on a few weaknesses common in browsers, including password manager issues and user interface vulnerabilities. Feedback is more than welcome. Enjoy, tim Abstract ======== In this paper, we compare the security weaknesses and usability limitations of both cookie-based session management and HTTP digest authentication; demonstrating how digest authentication is clearly the more secure system in practice. We propose several small changes in browser behavior and HTTP standards that will make HTTP authentication schemes, such as digest authentication, a viable option in future application development. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Paper: Weaning the Web off of Session Cookies Timothy D. Morgan (Jan 26)
- Re: [Webappsec] Paper: Weaning the Web off of Session Cookies James Landis (Jan 28)
- Re: [Webappsec] Paper: Weaning the Web off of Session Cookies Arian J. Evans (Jan 28)
- Re: [Webappsec] Paper: Weaning the Web off of Session Cookies Timothy D. Morgan (Jan 30)
- Re: [Webappsec] Paper: Weaning the Web off of Session Cookies Arian J. Evans (Jan 31)
- Re: [Webappsec] Paper: Weaning the Web off of Session Cookies Timothy D. Morgan (Jan 30)
- Re: [Webappsec] Paper: Weaning the Web off of Session Cookies Arian J. Evans (Jan 31)
- Re: [Webappsec] Paper: Weaning the Web off of Session Cookies Arian J. Evans (Jan 28)
- Re: [Webappsec] Paper: Weaning the Web off of Session Cookies James Landis (Jan 28)