Re: Are AuthTickets Secure?

You are right. The cookie is vulnerable to theft if the channel is not
encypted. Use SSL for all serious secure sites.

In my opinion, the encryption of the cookie primarily serves to make it
opaque to the end user.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Dima Maltsev" <Dima Maltsev@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:6C6E9081-85B5-4B40-8891-29EBC2FF626E@xxxxxxxxxxxxxxxx
HI All,

I've a question about AuthTickets.

Microsoft recommends using either SSL for all pages or Envcryption to
protect the AuthTicket. Here is the quote from the
http://support.microsoft.com/kb/813829/ page:

"How to Help Make Forms Authentication Secure
. Use SSL for all pages.
. Use the Encrypt method of the FormsAuthentication class."


While I understand why SSL would protect the ticket, I have the following
concern regarding the second (Encryption) option.
If a user after logging in clicks on a page which is being served over
HTTP,
the AuthTicket is still being sent back to a browser in a cookie. Such
requests (for non secure (HTTP) pages) can be intercepted by "a man in the
middle". Even though the AuthTicket is encrypted, it can be used as is by
a
hacker to hijack the user's session.

Am I missing something? Can anybody comment on this?

Thanks,
Dima Maltsev



.

Relevant Pages

  • Re: firewalls that can ssl ftp?
    ... Secure Transfers ... Bruce Schneier's Blowfish encryption for data transfers. ... Secure SSL based Web Administration Portal ... Works with other FTP Clients/Servers ...
    (Security-Basics)
  • Re: At What Point Does the Security Begin?
    ... All secure forms examine this variable, and if empty redirect to the ... all pages behind the login are posted through SSL. ... in which I understand .NET uses a cookie behind ... not secure (it's called at http, not https) but posts to a page ...
    (microsoft.public.dotnet.security)
  • Re: When do you turn off your Ubuntu boxes?
    ... what do you use for the mail server? ... encryption is necessary because I do everything on localhost. ... SSL only works if both ... was much that could be done to secure mail on the way out other than ...
    (Ubuntu)
  • Re: At What Point Does the Security Begin?
    ... OK - if ALL pages the user access afterwards are behind SSL and the use cannot somehow "log out" and come back to the non-SSL area, ... Otherwise the browser will happily send the session cookie also for non-SSL resources. ... All secure forms examine this variable, and if empty redirect to the ... page through https that does the username/password lookups, ...
    (microsoft.public.dotnet.security)
  • Slightly OT: encryption
    ... I'm trying to setup a system of secure encryption for exchanges between ... It occurred that if I could store the password at the browser end, ... If I put it in a secure cookie or a cookie with an obfusticated path it ...
    (comp.lang.php)