Re: SSL

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Peter O'Reilly (Peter_OReilly_at_timeinc.com!N!O!.S!P!AM!)
Date: 04/28/04 

Date: Wed, 28 Apr 2004 14:02:40 -0400

"Mark" <field027@idonotlikejunkmail.umn.edu> wrote in message
news:OO61CEULEHA.2260@TK2MSFTNGP09.phx.gbl...
> Ah, good point. Let's assume I'm using SSL. What would it take for an
> authenticated user sitting at their client browser to modify their clear
> text ram based cookie values?
>

Your original message mentioned worries of a hacker. Your example above
notes
an authenticated user. The way I see it, how the hacker managed to get past
authentication is the greater risk
and concern.

In other words, if the person authenticated is really the person intended to
use the application, I do not see how any of what is contained in their
cookie would be alarming as they are undoubtedly aware of their own social
security number, credit card number, application settings selected or
inputted, etc.

Encrypted or not, keep in mind though that the user may see what cookie is
being set, even if it's a session (memory resident) cookie, using such
browsers as Mozilla and having such cookie alert setting turned on.

If such security is really paramount, I would create a cookie containing an
encrypted id that points to the user's session information contained on the
server such as a database. This plus implementing SSL is about as stealth
as one can imagine. 

-- 
Peter O'Reilly

Relevant Pages

  • Re: ASP.NET choke when trying to delete cookies
    ... directory smart which sits on top of the windows AD and authenticated user ... > I suspect it's unrelated to setting the expiration on the cookie. ...
    (microsoft.public.dotnet.framework.aspnet)
  • get returning user for forms auth?
    ... application-specific session variables for that user. ... user again when he reenters the site; I pondered checking auth cookie ... How do I find out that authenticated user is re- ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Forms based security
    ... > Hi Charlie, ... > To get the form authentication cookie, you may get the cookie name from: ... > Authenticated user and others, you can just leave the content public. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: Forms based security
    ... To get the form authentication cookie, you may get the cookie name from: ... Authenticated user and others, you can just leave the content public. ... (This posting is provided "AS IS", with no warranties, and confers no ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Reality Check: Session Hijacking
    ... choice to force the visitor to accept session cookies to keep the session ... cookie is simply a cookie that dies when the browser is closed, ... Note that the visitor will not see the new URL in the browser (it still says ... implementing "if not SSL then unset isAuthenticated". ...
    (comp.lang.php)