Re: Secure web site access and PKI Certs

From: Scott Schwendinger (swschwen_at_yahoo.com)
Date: 04/27/05

  • Next message: /boot: "Re: how to block ALL AIM traffic ?" 
    Date: Wed, 27 Apr 2005 14:38:05 -0700 (PDT)
To: Keenan Smith <kc_smith@clark.net>, security-basics@securityfocus.com

    Keenan,

       If the PKI certificate is installed on the local
    machine with the "Enable Strong Private Key
    Protection..." checked, a password will be required
    each time the certificate is used. This will provide
    additional security for Single Sign On to PKI enabled
    web sites.

    --- Keenan Smith <kc_smith@clark.net> wrote:
    > All,
    >
    > I have access to a secure web site. It used to
    > require a PKI Cert to
    > identify the user and then a standard
    > username/password login to
    > authenticate.
    >
    > Recently a change was made to the site that allows
    > the supplying of a
    > PKI Subject CN Fragment to a user "profile" on the
    > site. In this case,
    > the certificate not only identifies the user but
    > authenticates as well.
    >
    > The end result is an "auto-login" feature that in
    > effect, keeps me
    > logged in all the time. Anybody sitting at my
    > machine and logged in as
    > me (Windows XP) can access the web site as me.
    >
    > At first glance this seems like it's a reasonable
    > way to accomplish a
    > secure access to the web site. Installing the
    > certificate as me ties it
    > to my profile and makes it unavailable to other
    > users on my machine and
    > since the use of the certificate requires a user to
    > login as me, it
    > moves the authentication piece from the web site to
    > the Windows domain.
    >
    > This seems to some extent like "security through
    > obscurity" and also
    > substituting convenience for security, an
    > all-to-common problem.
    >
    > Since it's my security-cleared neck on the line, I'd
    > rather be too
    > concerned rather than not concerned enough.
    >
    > So I'm asking the collective wisdom of the list to
    > consider. Is PKI's
    > single sign-on capability reasonable? Is this
    > implementation adequate?
    > Thoughts? Opinions? Critiques?
    >
    > Thanks
    > Keenan Smith
    >
    >

    __________________________________________________
    Do You Yahoo!?
    Tired of spam? Yahoo! Mail has the best spam protection around
    http://mail.yahoo.com

  • Next message: /boot: "Re: how to block ALL AIM traffic ?"

    Relevant Pages

    • [NT] Flaw in Certificate Enrollment Control Could Allow Deletion of Digital Certificates
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Certificate Enrollment Control, the purpose of which is to allow web-based ...
      (Securiteam)
    • Re: Embedding Simple MFC GUI app into website
      ... The problem with security is that so many people say "it doesn't matter". ... particular technology is "evil" goes beyond common sense and increases ... Since you must obtain a certificate for code signing from the trusted ... use it for a general purpose web site as we have all discussed, ...
      (microsoft.public.vc.mfc)
    • Re: REVIEW: "Understanding PKI", Carlisle Adams/Steve Lloyd
      ... | a public key infrastructure (PKI) is reviewed in chapter three. ... Certificate revocation, in chapter ... | chapter eighteen lists major standards. ... any number of general security texts provide as much detail on ...
      (comp.security.misc)
    • Re: REVIEW: "Understanding PKI", Carlisle Adams/Steve Lloyd
      ... | a public key infrastructure (PKI) is reviewed in chapter three. ... Certificate revocation, in chapter ... | chapter eighteen lists major standards. ... any number of general security texts provide as much detail on ...
      (alt.computer.security)
    • Re: Site Security Scan
      ... > breaches of security that it could find. ... > certificate of some sort at the end to show our clients that our site ... On-site reviews ... certificate saying your web site is safe!!! ...
      (comp.security.misc)