Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: [Webappsec] Paper: Weaning the Web off of Session Cookies
From: "Timothy D. Morgan" <tmorgan () vsecurity com>
Date: Sat, 30 Jan 2010 11:19:58 -0800

Arian,

Regarding SSO - not at all. Not even remotely. It's not about
"wrappers frameworks put around cookies".

That's exactly what it's about.  Cookies are name value pairs sent and
received based on simple rules.  Rules that happen to be poorly
standardized with few guarantees.  Everything else is what you make of
it: frameworks and protocols that use this primitive as they see fit.

Spend some time on *.yahoo* and *.google* and their partner sites, and
look at how they use both auth and personalization cookies (two
different things).

Whatever google and yahoo and social-networking-site-fad-of-the-month
are doing doesn't really matter to most web developers and
applications.  Let them keep their cookies.  Most applications will be
better off with a standardized authentication protocol.

For the former there is no way to solve usefully with Digest without
implementing some persistent unified tracking mechanism of the likes
Digest Auth does not provide today, or implementing some massive OoB
auth-sharing mechanism like SAML, or combining with something like
SXIP or OpenID. None of these latter give us the changeable
persistence bits we want and need though, when passing auth around
multi-domain/host properties.

Digest authentication may lack long-term persistence, I give you that,
but it makes up for it with better defined cross-domain properties.
What I suspect you haven't read up on is the intended use of the
opaque value (and perhaps server-side nonces) in digest
authentication.  These can be used to pass information between servers
without any out of band mechanism.  Look a lot like cookies, eh?

Also note that I clear all of my cookies whenever I close my browser
and I explicitly reject cross-domain cookies.  I'm not alone.  Now
where did the utility of cookie persistence go again...?  The fact of
the matter is:

  persistence + cross-domain = privacy problem


Sure, it would work fine for isolated financial apps with no
off-domain links. But that's not the direction the web is moving in.

Auth != Security

Auth != Confidentiality

Auth = Identity

That's the future, like it or not. Cookies are not only "good enough",
but they have distinct advantages over Digest when it comes to
verifying and tracking Identity.

But this stuff makes for good thought so keep the ideas rolling,


You speak in grandiose generalities, but have yet to describe any
detail.  Care to expand on your argument with something concrete?

tim

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault