Re: Account Creation and Security

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance




If security is really an issue you should consider using SSL
that is about the only way to protect session hijacking etc.

NTLM is also pretty good but managing the accounts can be
a pain

a nice solution is to use your own basic authentication over ssl
this allows you to manage and use the user database as you wish
whilst skipping getting involved in windows authentication
and letting users login using the login prompt in browsers and save
their passwords if they wish, plus you get to use the realm parameter
to say something cool !

all you need to do it is read up on www-authenticate header and base64
encoding
this also allows for "roaming web sessions" - where one of your
customers can
login at home and then later at work and still be in the same session
(ie: his
shopping basket has the same products in as at home)

it is the slickest solution outside of ntlm

.

Relevant Pages

  • Re: iis 6 ssl redirect initial login encrypted?
    ... Whilst the password isn't passed using either NTLM or Kerberos, it's not necessary for an attacker to know the password. ... another login box that uses https:// ... I just need to> get ssl ...
    (microsoft.public.inetserver.iis.security)
  • Re: Advice on when to use SSL? esp. Session ID security
    ... round trip (I believe this is what IIS does for its own session identifier). ... Obviously I'll be using it on the login page, ... > think about retaining SSL for the duration of the user's session? ... > user logs on and returns to a standard HTTP connection. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • session security
    ... Currently all of my php pages use SSL, not just my initial login. ... A leaked session id enables the third party to access all resources which are associated with a specific id. ...
    (comp.lang.php)
  • Re: Login über HttpWebRequest
    ... Welche Art von Login, kann ich leider nicht sagen, nur nach dem ... Ich dachte, dass ich das mit der Session über den Cookie hinbekomme, aber da ... Basic Authentifizierung, NTLM, ...
    (microsoft.public.de.german.entwickler.dotnet.vb)
  • OWA and SSL
    ... Is there a way to have SSL enabled for just the ... login of OWA, then, not use SSL for the rest of the session? ... Or is it advisable to keep SSL throughout the session? ...
    (microsoft.public.exchange.admin)