[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Re: Cookies at XML Europe 2004 -- Call for Particip ati

• To: Elliotte Rusty Harold <elharo@m...>
• Subject: Re: Re: Cookies at XML Europe 2004 -- Call for Particip ation
• From: Rich Salz <rsalz@d...>
• Date: Tue, 06 Jan 2004 11:53:03 -0500
• Cc: XML-DEV <xml-dev@l...>
• In-reply-to: <p06010203bc2071a8d656@[192.168.254.4]>
• References: <Pine.LNX.4.44L0.0401052326150.4127-100000@s...> <p06010203bc2071a8d656@[192.168.254.4]>
• User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4b) Gecko/20030507

I know about digest-auth.  Yes, it sends a hash (not encrypted password) 
rather than the plaintext.  But it sends it every time which they admit 
isn't terribly secure, it is subject to dictionary attacks (with new 
data every time the nonce expires), and it uses the deprecated MD-5 as 
opposed to SHA-1.  It also doesn't *seem* (in my quick test) to be 
supported by IE, which knocks out a large part of the net.  (Always a 
tip-off when folks use the phrase "supported by modern browsers," I've 
done it myself.:)

Good security requires state.  Bad security leaves your login passwords 
lying around. Using a cookie to maintain a timed-out login session seems 
the best way to do good and avoid bad. And since I don't believe that 
RFC 2109 violates web architecture, we'll just have to agree to disagree.

Happy new year.
	/r$
-- 
Rich Salz, Chief Security Architect
DataPower Technology                           http://www.datapower.com
XS40 XML Security Gateway   http://www.datapower.com/products/xs40.html
XML Security Overview  http://www.datapower.com/xmldev/xmlsecurity.html

• Follow-Ups:
  • Re: Re: Cookies at XML Europe 2004 -- Call for Particip ation
    • From: jcowan@r...
  • Re: Re: Cookies at XML Europe 2004 -- Call for Particip ation
    • From: Elliotte Rusty Harold <elharo@m...>

• References:
  • RE: Re: Cookies at XML Europe 2004 -- Call for Particip ation
    • From: Rich Salz <rsalz@d...>
  • RE: Re: Cookies at XML Europe 2004 -- Call for Particip ation
    • From: Elliotte Rusty Harold <elharo@m...>

• Prev by Date: Re: Formalism and complexity
• Next by Date: RE: Re: Cookies at XML Europe 2004 -- Call for Particip ation
• Previous by thread: RE: Re: Cookies at XML Europe 2004 -- Call for Particip ation
• Next by thread: Re: Re: Cookies at XML Europe 2004 -- Call for Particip ation
• Index(es):
  • Date
  • Thread