[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Re: Cookies at XML Europe 2004 -- Call for Participation

• To: Rich Salz <rsalz@d...>
• Subject: Re: Re: Cookies at XML Europe 2004 -- Call for Participation
• From: jcowan@r...
• Date: Mon, 5 Jan 2004 15:03:49 -0500
• Cc: xml-dev@l...
• In-reply-to: <3FF9B446.7020003@d...>
• References: <p06010205bc1f30963822@[192.168.254.4]> <1073317356.8730.123.camel@saag> <p06010207bc1f5c8d8c6f@[192.168.254.4]> <3FF9B446.7020003@d...>
• User-agent: Mutt/1.4.1i

Rich Salz scripsit:

> HTTP auth requires SSL for all connections or else passwords can be 
> stolen -- do you include that in your "setup in 5 minutes" overhead? 
> With cookies, you only need SSL on the login page if you make the cookie 
> be an opaque ID into server state that has a time-out.  In general, 
> login cookies are more secure with less overhead.

What is to prevent replay attacks in the cookie scenario you describe?
A timeout only prevents *delayed* replay attacks.

-- 
They do not preach                              John Cowan
  that their God will rouse them                jcowan@r...
    A little before the nuts work loose.        http://www.ccil.org/~cowan
They do not teach                               http://www.reutershealth.com
  that His Pity allows them                         --Rudyard Kipling,
    to drop their job when they damn-well choose.   "The Sons of Martha"

• Follow-Ups:
  • Re: Re: Cookies at XML Europe 2004 -- Call for Participation
    • From: Rich Salz <rsalz@d...>

• References:
  • Cookies at XML Europe 2004 -- Call for Participation
    • From: Elliotte Rusty Harold <elharo@m...>
  • Re: Cookies at XML Europe 2004 -- Call for Participation
    • From: Edd Dumbill <edd@u...>
  • Re: Cookies at XML Europe 2004 -- Call for Participation
    • From: Elliotte Rusty Harold <elharo@m...>
  • Re: Re: Cookies at XML Europe 2004 -- Call for Participation
    • From: Rich Salz <rsalz@d...>

• Prev by Date: RE: xml editor to design forms
• Next by Date: RE: Re: Cookies at XML Europe 2004 -- Call for Particip ation
• Previous by thread: Re: Re: Cookies at XML Europe 2004 -- Call for Participation
• Next by thread: Re: Re: Cookies at XML Europe 2004 -- Call for Participation
• Index(es):
  • Date
  • Thread