[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Re: Cookies at XML Europe 2004 -- Call for Participation

• To: Elliotte Rusty Harold <elharo@m...>
• Subject: Re: Re: Cookies at XML Europe 2004 -- Call for Participation
• From: Rich Salz <rsalz@d...>
• Date: Thu, 08 Jan 2004 12:53:48 -0500
• Cc: xml-dev@l...
• In-reply-to: <p06010209bc233f0179a9@[192.168.254.4]>
• References: <20040108000125.GI31886@m...> <Pine.LNX.4.44L0.0401072052010.11874-100000@s...> <20040108115451.GP31886@m...> <3FFD4836.4000705@a...> <p06010202bc230c579249@[192.168.254.4]> <3FFD7817.509@a...> <p06010209bc233f0179a9@[192.168.254.4]>
• User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4b) Gecko/20030507

> If 
> somebody's trying to brute force guess passwords by logging in 
> repeatedly, that's pretty much the same issue with either cookies or 
> digest authentication.

No.  If I can get the plaintext request and response to a HTTP 
digest-auth message, than I can do my attack completely offline without 
involving the server at all.  That is a *huge* difference compared to 
repeatedly trying to log in (i.e., guess the password).  And remember, 
what's then been broken is the clients login password, not a 
finite-lifetime session key.

Given the recent messages and links about digest, I think we have to 
admit that it's a non-interoperable mechanism that's only slightly 
better than basic-auth and it's client-side management facilities and 
end-user knowledge is worse than cookies.
	/r$
-- 
Rich Salz, Chief Security Architect
DataPower Technology                           http://www.datapower.com
XS40 XML Security Gateway   http://www.datapower.com/products/xs40.html
XML Security Overview  http://www.datapower.com/xmldev/xmlsecurity.html

• Follow-Ups:
  • Re: Re: Cookies at XML Europe 2004 -- Call forParticipation
    • From: Elliotte Rusty Harold <elharo@m...>

• References:
  • Re: Re: Cookies at XML Europe 2004 -- Call for Participation
    • From: John Cowan <cowan@m...>
  • Re: Re: Cookies at XML Europe 2004 -- Call for Participation
    • From: Rich Salz <rsalz@d...>
  • Re: Re: Cookies at XML Europe 2004 -- Call for Participation
    • From: John Cowan <cowan@m...>
  • Re: Re: Cookies at XML Europe 2004 -- Call for Participation
    • From: Alaric B Snell <alaric@a...>
  • Re: Re: Cookies at XML Europe 2004 -- Call forParticipation
    • From: Elliotte Rusty Harold <elharo@m...>
  • Re: Re: Cookies at XML Europe 2004 -- Call for Participation
    • From: Alaric B Snell <alaric@a...>
  • Re: Re: Cookies at XML Europe 2004 -- Call forParticipation
    • From: Elliotte Rusty Harold <elharo@m...>

• Prev by Date: RE: Urgent help needed. XML Parser
• Next by Date: Re: Re: Cookies at XML Europe 2004 -- Call for Participation
• Previous by thread: Re: Re: Cookies at XML Europe 2004 -- Call forParticipation
• Next by thread: Re: Re: Cookies at XML Europe 2004 -- Call forParticipation
• Index(es):
  • Date
  • Thread