You are viewing a plain text version of this content. The canonical link for it is here.
Posted to modperl@perl.apache.org by Martin Moss <ma...@btopenworld.com> on 2004/11/08 15:27:16 UTC
Protecting against Cookie copying
All,
I'm looking into ways of uniquely identifying a
computer. I've been reading around the web looking at
different mechanisms, and so far I've drawn a fuzzy
blank. Currently, I want to use SSL to let a user sign
in and then I return a session cookie, which I then
use to confirm the user is logged in when they come to
non-ssl pages.
What I wish to do is prevent another user copying the
session cookie, from one computer to another, and then
gaining access. Originally I wondered if I could get
at the mac address of the connection, but that seems
to be a dead end. After a little further reading It
seems that there is a UUID generated at the handshake?
stage of SSL, so therefore I wonder if I can use this,
e.g. map my session_id to a UUID, and then when I
check the session is valid I crosscheck this, however
I'm not sure if I can get the UUID over a non-SSL
connection.
I'm sure I'm not the first person to want to uniquely
identify a computer that comes to my site, without
blindly trusting cookies, but I'm at a loss of how to
find anything better than ipaddress to session cookie
mapping. (which is kinda pointless for Natted
addresses I know).
Does anybody have any ideas, pointers...?
Regards
Marty
___________________________________________________________ALL-NEW Yahoo! Messenger - all new features - even more fun! http://uk.messenger.yahoo.com
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: Protecting against Cookie copying
Posted by Rici Lake <ri...@ricilake.net>.
Disclaimer: the following is all "to the best of my knowledge".
Take it for what it's worth.
On 8-Nov-04, at 9:27 AM, Martin Moss wrote:
> so therefore I wonder if I can use this,
> e.g. map my session_id to a UUID, and then when I
> check the session is valid I crosscheck this, however
> I'm not sure if I can get the UUID over a non-SSL
> connection.
Assuming you're talking about the SSL session-id, that
is only available over an SSL connection. Even with SSL
connections, there is actually nothing stopping the
client from opening more than one SSL connection and
therefore having more than one SSL connection-id.
So that seems to me like a dead end.
> I'm sure I'm not the first person to want to uniquely
> identify a computer that comes to my site, without
> blindly trusting cookies, but I'm at a loss of how to
> find anything better than ipaddress to session cookie
> mapping. (which is kinda pointless for Natted
> addresses I know).
It is very hard to trust anything that comes in over
a non-ssl connection. If you are concerned about security,
I'd recommend using ssl consistently throughout the
session. This will at least deal with the case where
cookies are stolen by monitoring the connection (assuming
you've taken adequate care to avoid man-in-the-middle
attacks).
Stealing a session cookie from the client's cookie jar is
harder to protect against. On the other hand, it is perhaps
not so easy to do. One might think that a security-conscious
browser would not commit session cookies to disk, but I
don't know which (if any) browsers do this (and in any event,
it may be possible to snatch them out of memory, or through
some XSS hack.)
All the same, session cookies with SSL are a reasonably secure
mechanism; "good enough" unless you are running a site which
requires a very high degree of security. In the latter case,
you probably want to investigate client SSL certificates and/or
other high-grade security solutions.
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: Protecting against Cookie copying
Posted by Perrin Harkins <pe...@elem.com>.
On Mon, 2004-11-08 at 09:27, Martin Moss wrote:
> What I wish to do is prevent another user copying the
> session cookie, from one computer to another, and then
> gaining access.
If you're talking about packet sniffing attacks, use SSL and call it a
day. If you're talking about a technically advanced user who has access
to your site signing in with LWP or similar and then moving the cookie
to another machine, forget it. There is nothing you can do to prevent
this that won't cause problems for some segment of potential users.
- Perrin
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: Protecting against Cookie copying
Posted by Martin Moss <ma...@btopenworld.com>.
Thanks everyone. You've done a good job of assuring me
that I haven't missed the whole point of the way these
things work.
There's been some really useful ideas, suggested and
I'm going to have a think about which, if any, are
worth implementing.
Ultimitely I'm upgrading our site from normal Basic
authentication, which sends username and password
unencrypted anyway, so compared to that the security
upgrade is still a big increase!
Marty
--- Sam Tregar <sa...@tregar.com> wrote:
> On Mon, 8 Nov 2004, Martin Moss wrote:
>
> > I'm looking into ways of uniquely identifying a
> > computer.
>
> Intel tried to implement this a while back with a
> unique ID in the
> CPU. The public was not ammused. If you do find a
> way, please tell
> us so we can find a workaround.
>
> > What I wish to do is prevent another user copying
> the
> > session cookie, from one computer to another, and
> then
> > gaining access.
>
> You can get close by using a very short session
> timeout, tying the IP
> to the cookie and putting a serial number on each
> form. I believe
> this is what my bank does. Sure, the IP can be
> spoofed or shared, and
> hackers can automate systems to defeat the timeouts
> and serial
> numbers, but it definitely raises the bar. As an
> added bonus, the
> serial numbers also help with the ubiquitous
> catastrophe which is the
> back button.
>
> -sam
>
> --
> Report problems: http://perl.apache.org/bugs/
> Mail list info:
> http://perl.apache.org/maillist/modperl.html
> List etiquette:
> http://perl.apache.org/maillist/email-etiquette.html
>
>
___________________________________________________________ALL-NEW Yahoo! Messenger - all new features - even more fun! http://uk.messenger.yahoo.com
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: Protecting against Cookie copying
Posted by Sam Tregar <sa...@tregar.com>.
On Mon, 8 Nov 2004, Martin Moss wrote:
> I'm looking into ways of uniquely identifying a
> computer.
Intel tried to implement this a while back with a unique ID in the
CPU. The public was not ammused. If you do find a way, please tell
us so we can find a workaround.
> What I wish to do is prevent another user copying the
> session cookie, from one computer to another, and then
> gaining access.
You can get close by using a very short session timeout, tying the IP
to the cookie and putting a serial number on each form. I believe
this is what my bank does. Sure, the IP can be spoofed or shared, and
hackers can automate systems to defeat the timeouts and serial
numbers, but it definitely raises the bar. As an added bonus, the
serial numbers also help with the ubiquitous catastrophe which is the
back button.
-sam
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html