[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Re: Cookies at XML Europe 2004 -- Call for Participation

• To: Elliotte Rusty Harold <elharo@m...>
• Subject: Re: Re: Cookies at XML Europe 2004 -- Call for Participation
• From: Rich Salz <rsalz@d...>
• Date: Thu, 08 Jan 2004 13:08:26 -0500
• Cc: "xml-dev@l..." <xml-dev@l...>
• In-reply-to: <p06010200bc22806597e5@[192.168.254.4]>
• References: <Pine.LNX.4.44L0.0401071853240.11874-100000@s...> <p06010200bc22806597e5@[192.168.254.4]>
• User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4b) Gecko/20030507

> Bottom line: SSL on: everything is safe. SSL off: HTTP digest 
> authentication, while not perfect given likely weak passwords, is more 
> secure than cookie based authentication.

No.  With SSL on, everything is safe, except that we've seen that 
digest-auth doesn't have interoperable implementations, and it's 
repeatedly using your login password which is a very bad thing.  You 
don't believe so, oh well. I don't have time to look it up, but the IETF 
security WG disallowed this kind of thing in LDAP for exactly that reason.

Without SSL, the risk is "offline attack on gets long-term password" for 
digest, and for cookie its "packet snarf gets limited access."  That 
tradeoff alone would make the concerned (or liable) party tend to go for 
cookies, don'tcha think?  And the cookie risks can be mediated in 
several ways, including:
1.  Make the lifetime short, but renewable; long enough for the expected 
transaction lifetime (e.g., time spent through the shopping cart)
2.  Make the lifetime be a "number of uses" count.  This would make it 
obvious to client and server when someone has stolen the session, not 
something possible with an off-line dictionary attack against digest-auth.
3.  (As Alaric mentioned) require re-login and SSL when entering the "no 
turning back" phase.

Things may be worse than you think, but only if you try to use digest. :)
	/r$
-- 
Rich Salz, Chief Security Architect
DataPower Technology                           http://www.datapower.com
XS40 XML Security Gateway   http://www.datapower.com/products/xs40.html
XML Security Overview  http://www.datapower.com/xmldev/xmlsecurity.html

• Follow-Ups:
  • Re: Re: Cookies at XML Europe 2004 -- Call forParticipation
    • From: Elliotte Rusty Harold <elharo@m...>

• References:
  • Re: Re: Cookies at XML Europe 2004 -- Call for Participation
    • From: Rich Salz <rsalz@d...>
  • Re: Re: Cookies at XML Europe 2004 -- Call forParticipation
    • From: Elliotte Rusty Harold <elharo@m...>

• Prev by Date: Re: Why is xml:base a URI *reference*?
• Next by Date: Re: Re: Cookies at XML Europe 2004 -- Call for Participation
• Previous by thread: Re: Re: Cookies at XML Europe 2004 -- Call forParticipation
• Next by thread: Re: Re: Cookies at XML Europe 2004 -- Call forParticipation
• Index(es):
  • Date
  • Thread