Re: Login credentials and session id security

["Scott C. Sanchez" <scottsanchez () gmail com>]

If you are that concerned about a man in the middle attack, you should
consider two-factor auth.  IMO get vs post there is no security
difference if MITM is your worry.  Also make sure that you implement a
configurable lockout on failed login attempts, both for a specific
userid as well as from a specific IP or even from a whole subnet or
domain if you are truly paranoid of the proxies.  You may want to
display a "Your last successful login was: " and a "Your last failed
login was: " to the user.

As for two-factor, for ease of deployment & management I have been
using the token solution from http://www.mypw.com - it's like a hosted
securid product but at a much lower cost.  If you need contact info,
contact me off-list.

Good luck.

-Scott C. Sanchez, CISSP




On 6/6/07, Vishal Garg <vishal () firstbase co uk > wrote:
> Hi All,
>
> Can someone please tell what is the most secure way of sending login
> credentials to the server. The possible ways that I am familiar with are:
>
> - get method
> - post method
> - hidden form fields
>
> By using an encrypted connection we cannot sniff the credentials, but
> still it is very easy to capture or manipulate these credentials
> using a web proxy from any of these methods. So I am looking to find
> a method to transport the credentials to the server so that the
> security of these credentials can't be compromised even by deploying
> a web proxy.
>
> Also once a session id is generated, what is the best way to maintain
> the security of a session id.
>
> Any help would be much appreciated.
>
> Regards
> Vishal
>
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
>
> The Twelve Most Common Application-level Hack Attacks
> Hackers continue to add billions to the cost of doing business online
> despite security executives' efforts to prevent malicious attacks. This
> whitepaper identifies the most common methods of attacks that we have seen,
> and outlines a guideline for developing secure web applications.
> Download today!
>
>  https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe
> --------------------------------------------------------------------------

-------------------------------------------------------------------------
Sponsored by: Watchfire

The Twelve Most Common Application-level Hack Attacks
Hackers continue to add billions to the cost of doing business online 
despite security executives' efforts to prevent malicious attacks. This 
whitepaper identifies the most common methods of attacks that we have seen, 
and outlines a guideline for developing secure web applications. 
Download today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe
--------------------------------------------------------------------------