Vishal,
Best way to protect the proxy,MITM and DNS poisoning attacks is use of
One time tokens.
But they are also prone to Active MITM attacks.In order to achieve a
fool proof method better surrender yourself to cryptography(Zero
Knowledge proofs ) SRP(http://srp.stanford.edu/) based implementation
is a good start in which you dont effectively send the password.
This article will give some insights of how to protect the
webapplication from session
hijacking.(http://technicalinfo.net/papers/WebBasedSessionManagement.html)
Hope this Helps
Regards
AK
On 6/6/07, Vishal Garg <vishal_at_firstbase.co.uk> wrote:
> Hi All,
>
> Can someone please tell what is the most secure way of sending login
> credentials to the server. The possible ways that I am familiar with are:
>
> - get method
> - post method
> - hidden form fields
>
> By using an encrypted connection we cannot sniff the credentials, but
> still it is very easy to capture or manipulate these credentials
> using a web proxy from any of these methods. So I am looking to find
> a method to transport the credentials to the server so that the
> security of these credentials can't be compromised even by deploying
> a web proxy.
>
> Also once a session id is generated, what is the best way to maintain
> the security of a session id.
>
> Any help would be much appreciated.
>
> Regards
> Vishal
>
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
>
> The Twelve Most Common Application-level Hack Attacks
> Hackers continue to add billions to the cost of doing business online
> despite security executives' efforts to prevent malicious attacks. This
> whitepaper identifies the most common methods of attacks that we have seen,
> and outlines a guideline for developing secure web applications.
> Download today!
>
> https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe
> --------------------------------------------------------------------------
>
>
-------------------------------------------------------------------------
Sponsored by: Watchfire
The Twelve Most Common Application-level Hack Attacks
Hackers continue to add billions to the cost of doing business online
despite security executives' efforts to prevent malicious attacks. This
whitepaper identifies the most common methods of attacks that we have seen,
and outlines a guideline for developing secure web applications.
Download today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe
--------------------------------------------------------------------------
Received on Jun 08 2007
Intro
