RE: Cookies as the second factor

["Matt Fisher" <mfisher () spidynamics com>]

If you own the customer base, you could almost use the persistent cookie
like an SSL cert (in a sense at least) since you could just preload it
onto user machines ;) 

-----Original Message-----
From: Jeff Robertson [mailto:jeff.robertson () digitalinsight com] 
Sent: Tuesday, July 18, 2006 1:01 PM
To: Ryan Barnett; Rogan Dawes
Cc: webappsec () securityfocus com
Subject: RE: Cookies as the second factor

> -----Original Message-----
> From: Ryan Barnett [mailto:rcbarnett () gmail com] 
>
> I think we are mixing persistent/session cookie concepts 
> here.  I believe that the scenario that Jeff was trying to 
> describe (and please correct me Jeff if I am wrong here) is 
> if you use both a password and a persistent cookie to 
> initially log into an appliaction and then the app can issue 
> whatever sesisonid cookies it needs to track the session 
> state and provide authorization.

Yes, this is the kind of thing I was thinking about.


------------------------------------------------------------------------
-
Sponsored by: Watchfire

AppScan 6.5 is now available! New features for Web Services Testing, 
Advanced Automated Capabilities for Penetration Testers, PCI Compliance 
Reporting, Token Analysis, Authentication testing, Automated JavaScript 
execution and much more. 
Download a Free Trial of AppScan today!

https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
------------------------------------------------------------------------
-


-------------------------------------------------------------------------
Sponsored by: Watchfire

AppScan 6.5 is now available! New features for Web Services Testing,
Advanced Automated Capabilities for Penetration Testers, PCI Compliance
Reporting, Token Analysis, Authentication testing, Automated JavaScript
execution and much more.
Download a Free Trial of AppScan today!

https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
-------------------------------------------------------------------------