[Full-disclosure] Paper: Weaning the Web off of Session Cookies
- From: "Timothy D\. Morgan" <tmorgan@xxxxxxxxxxxxx>
- Date: Tue, 26 Jan 2010 11:05:09 -0800
I've just posted a new paper some of you may be interested in:
While it's primarily an argument for fixing HTTP authentication, it
does contain information on a few weaknesses common in browsers,
including password manager issues and user interface vulnerabilities.
Feedback is more than welcome.
In this paper, we compare the security weaknesses and usability
limitations of both cookie-based session management and HTTP digest
authentication; demonstrating how digest authentication is clearly the
more secure system in practice. We propose several small changes in
browser behavior and HTTP standards that will make HTTP authentication
schemes, such as digest authentication, a viable option in future
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- Prev by Date: [Full-disclosure] [ MDVSA-2010:026 ] openldap
- Next by Date: Re: [Full-disclosure] Disk wiping -- An alternate approach?
- Previous by thread: [Full-disclosure] [ MDVSA-2010:026 ] openldap
- Next by thread: Re: [Full-disclosure] [Webappsec] Paper: Weaning the Web off of Session Cookies