Re: Cookies as the second factor

[Rogan Dawes <discard () dawes za net>]

Robin Wood wrote:
> Javascript could be used to generate the cookie which is then passed
> back to the server with each request. This would save having to make
> sure a value was posted or passed on the query string on each request.
>
> Don't have time to think about how good this would be for
> authentication but I think techincally it can be done.
>
> Robin

That is actually quite an interesting approach to using a session 
identifier.

On the positive side, it means that you never send your password to the 
server. Depending on how clever your client-side javascript is, you may 
not even need to store the clear-text password on the server side (for 
verification purposes)

On the down side, it might expose you to session fixation attacks.

Regardless, I'd say that that cookie would then qualify as "something 
you know", rather than "something you have", since it is created based 
on your username and password.

Regards,

Rogan

-------------------------------------------------------------------------
Sponsored by: Watchfire

AppScan 6.5 is now available! New features for Web Services Testing, 
Advanced Automated Capabilities for Penetration Testers, PCI Compliance 
Reporting, Token Analysis, Authentication testing, Automated JavaScript 
execution and much more. 
Download a Free Trial of AppScan today!

https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
-------------------------------------------------------------------------