[Full-disclosure] Paper: Weaning the Web off of Session Cookies


Hello,

I've just posted a new paper some of you may be interested in:
http://www.vsecurity.com/download/papers/WeaningTheWebOffOfSessionCookies.pdf

While it's primarily an argument for fixing HTTP authentication, it
does contain information on a few weaknesses common in browsers,
including password manager issues and user interface vulnerabilities.

Feedback is more than welcome.

Enjoy,
tim


Abstract
========
In this paper, we compare the security weaknesses and usability
limitations of both cookie-based session management and HTTP digest
authentication; demonstrating how digest authentication is clearly the
more secure system in practice. We propose several small changes in
browser behavior and HTTP standards that will make HTTP authentication
schemes, such as digest authentication, a viable option in future
application development.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • Paper: Weaning the Web off of Session Cookies
    ... While it's primarily an argument for fixing HTTP authentication, ... limitations of both cookie-based session management and HTTP digest ... demonstrating how digest authentication is clearly the ...
    (Bugtraq)
  • Re: Protecting a whole directory - PHP Authentication
    ... you must be aware that you won't be able to use a custom login form if you use HTTP authentication. ... there's no way to tell the browser what to send for authentication credentials except through the HTTP authentication mechanism (i.e. no PHP or Javascript code can force it). ...
    (comp.lang.php)
  • Re: HTTP Authentication with multiple attempts
    ... > I have used the simple example of HTTP Authentication from the PHP website ... if the user gets it wrong they are locked-out until they ... No username/password is--for the ...
    (comp.lang.php)
  • Re: HTTP Authentication with multiple attempts
    ... >> I have used the simple example of HTTP Authentication from the PHP ... > then count the number of attempt within a given time period. ...
    (comp.lang.php)
  • Re: Digest Authentication on Win2003
    ... Digest Authentication requires that the user accounts are Domain accounts ... please get the free sample chapter from my IIS 6.0 ... authentication requires the IIS server to be a domain controller? ...
    (microsoft.public.inetserver.iis)