WebApp Sec: RE: Cookies as the second factor

["Andrew Chong" <andrewjw () singnet com sg>]

I guess the question put forward is how to achieve 2 factor
authentication.

The best way is to use a token based device (what you have). A good
recommendation is the Crypto Card which looks like a calculator. It cost
about USD$95 each.

If Crypto Card is too expensive, then you can implement a one-time
challeng PIN authentication to the user registered email. When a user
login correctly, a email containing a one-time PIN will be send to the
user registered email address. Once the email is receive, the user can
entered the PIN on the website again to login.

Regards,
Andrew Chong (Singapore), CISSP.

-----Original Message-----
From: Robin Wood [mailto:dninja () gmail com] 
Sent: Tuesday, July 18, 2006 11:03 PM
To: discard () dawes za net
Cc: Jeff Robertson; webappsec () securityfocus com
Subject: Re: Cookies as the second factor


Javascript could be used to generate the cookie which is then passed
back to the server with each request. This would save having to make
sure a value was posted or passed on the query string on each request.

Don't have time to think about how good this would be for authentication
but I think techincally it can be done.

Robin

On 7/18/06, Rogan Dawes <discard () dawes za net> wrote:
> Jeff Robertson wrote:
> > It seems like it's been mentioned on here before, that a number of 
> > "two factor" or "multi factor" authentication schemes actually use a
> > cookie as the second factor.
> >
> > Anyone here have specific experience with such solutions, or 
> > opinions about how much security they add to a system?
> Sounds completely bogus to me.
>
> The cookie is typically generated by the server, as a response to an 
> authentication event (single or multi-factor). The cookie is then used
> to maintain that authentication from request to request.
>
> There is NO authentication component in such a cookie. It is created 
> by the SERVER, and as such CANNOT qualify as an authentication factor 
> at all.
>
> Rogan
>
> ----------------------------------------------------------------------
> ---
> Sponsored by: Watchfire
>
> AppScan 6.5 is now available! New features for Web Services Testing, 
> Advanced Automated Capabilities for Penetration Testers, PCI 
> Compliance Reporting, Token Analysis, Authentication testing, 
> Automated JavaScript execution and much more. Download a Free Trial of
> AppScan today!
>
> https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CY
> kc
------------------------------------------------------------------------
-
>
------------------------------------------------------------------------
-
Sponsored by: Watchfire

AppScan 6.5 is now available! New features for Web Services Testing, 
Advanced Automated Capabilities for Penetration Testers, PCI Compliance 
Reporting, Token Analysis, Authentication testing, Automated JavaScript 
execution and much more. 
Download a Free Trial of AppScan today!

https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
------------------------------------------------------------------------
-

-- 
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.394 / Virus Database: 268.10.1/390 - Release Date:
7/17/2006
 

-- 
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.394 / Virus Database: 268.10.1/391 - Release Date:
7/18/2006
 


-------------------------------------------------------------------------
Sponsored by: Watchfire

AppScan 6.5 is now available! New features for Web Services Testing, 
Advanced Automated Capabilities for Penetration Testers, PCI Compliance 
Reporting, Token Analysis, Authentication testing, Automated JavaScript 
execution and much more. 
Download a Free Trial of AppScan today!

https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
-------------------------------------------------------------------------