Re: Cookies as the second factor

["Ryan Barnett" <rcbarnett () gmail com>]

Well, if the cookie was persistent, then maybe you could count that as
"Something you have" for authentication.  The trick is, how did you
verify the user during the initial issuance of the persistent cookie?
Catch-22 here.  This would have to treated in the same manner as
issuing PKI certs where you need verifiable proof that the user who is
receiving the software/device/cookie is the correct person.  When
issuing certs for smart cards, etc... you normally need a face-to-face
meeting.  There may also be an issue with the security levels
protecting the cookie on the computer.  How difficult would it be for
someone to gain access to the cookie stored on the computer?

--
Ryan C. Barnett
Web Application Security Consortium (WASC) Member
CIS Apache Benchmark Project Lead
SANS Instructor, GCIA, GCFA, GCIH, GSNA, GCUX, GSEC
Author: Preventing Web Attacks with Apache


On 7/18/06, Jeff Robertson <jeff.robertson () digitalinsight com> wrote:
> It seems like it's been mentioned on here before, that a number of "two
> factor" or "multi factor" authentication schemes actually use a cookie
> as the second factor.
>
> Anyone here have specific experience with such solutions, or opinions
> about how much security they add to a system?
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
>
> AppScan 6.5 is now available! New features for Web Services Testing,
> Advanced Automated Capabilities for Penetration Testers, PCI Compliance
> Reporting, Token Analysis, Authentication testing, Automated JavaScript
> execution and much more.
> Download a Free Trial of AppScan today!
>
> https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
> -------------------------------------------------------------------------

-------------------------------------------------------------------------
Sponsored by: Watchfire

AppScan 6.5 is now available! New features for Web Services Testing, 
Advanced Automated Capabilities for Penetration Testers, PCI Compliance 
Reporting, Token Analysis, Authentication testing, Automated JavaScript 
execution and much more. 
Download a Free Trial of AppScan today!

https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
-------------------------------------------------------------------------