Re: Cookies as the second factor

["Darren Bounds" <dbounds () gmail com>]

I'm not saying it's a good idea, just that it can done very easily.
Ronans posting made it appear technically impossible.

On 7/18/06, mikeiscool <michaelslists () gmail com> wrote:
> On 7/19/06, Darren Bounds <dbounds () gmail com> wrote:
> > There's no reason a cookie couldn't be generated client-side. I could
> > easily have a client-side application generate a 'secure', one-time
> > use token, populate a cookie and then use that value as one part of a
> > multi-factor authentication scheme.
>
> except that if your 'client' is compromised you are stuffed.
>
> two factor should work even in a client-compromised situation.
>
> -- mic


--

Thank you,
Darren Bounds

-------------------------------------------------------------------------
Sponsored by: Watchfire

AppScan 6.5 is now available! New features for Web Services Testing, 
Advanced Automated Capabilities for Penetration Testers, PCI Compliance 
Reporting, Token Analysis, Authentication testing, Automated JavaScript 
execution and much more. 
Download a Free Trial of AppScan today!

https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
-------------------------------------------------------------------------