URL sharing

[Antony Awaida <an...@apporto.com>]

Hi Guacamole team:

I do realize that Guacamole used Cookies before V1.0. Can you please
explain why Gucamole no longer uses cookies? Some users feel that sharing
URLs may not be as secure without using cookies.

Thoughts?

Thanks
Antony

ᐧ

Re: URL sharing

[Nick Couchman <vn...@apache.org>]

On Mon, Oct 5, 2020 at 4:14 PM Antony Awaida <an...@apporto.com> wrote:

> Thanks Nick.Pls note that this does not relate to connection sharing -
> rather it relates to a user passing his URL to another user.
>
> Many institutions are adding Multi-factor auth as an extra layer of
> security. They feel that while using Guac, a user can simply send his URL
> to another user and therefore bypass the layers of security.
>

I suppose this depends upon what you mean by "his URL."  A user could dig
in and find the token parameter of their session and share that with
someone else, and that would allow the person receiving that token to
basically act as the user who shared it.  The token should certainly be
protected, and, in most cases within the Guacamole Client application it is
hidden from the user.  It can be found using the developer console, but
does not usually appear in the address bar.

There was a JIRA suggestion/improvement put in a while back to remove the
token parameter from the URL and instead use a session variable or the like
to further hide that.  This would mitigate some of that risk, but, still,
one way or the other - whether it's a cookie, a session variable, or a URL
parameter, if someone is intent on finding it and giving it to someone
else, they are going to be able to do that, and there isn't a fool-proof
method of prevent users from abusing the system in that manner.

Otherwise, if you're just talking about the connection identifier
(#/client/base64stringhere), there is nothing in that URL that is sensitive
or would bypass any security measures - it's just a B64 encoding of the
data source, connection type, and identifier.

-Nick

>

Re: URL sharing

[Antony Awaida <an...@apporto.com>]

Thanks Nick.Pls note that this does not relate to connection sharing -
rather it relates to a user passing his URL to another user.

Many institutions are adding Multi-factor auth as an extra layer of
security. They feel that while using Guac, a user can simply send his URL
to another user and therefore bypass the layers of security.

Antony Awaida
CEO
www.apporto.com

2 min intro video:
https://www.youtube.com/watch?v=_F4pJtwD_Yg


ᐧ

On Mon, Oct 5, 2020 at 1:06 PM Nick Couchman <vn...@apache.org> wrote:

> On Mon, Oct 5, 2020 at 3:22 PM Antony Awaida <an...@apporto.com> wrote:
>
>> Hi Guacamole team:
>>
>> I do realize that Guacamole used Cookies before V1.0. Can you please
>> explain why Gucamole no longer uses cookies? Some users feel that sharing
>> URLs may not be as secure without using cookies.
>>
>> Thoughts?
>>
>>
> I believe that, in general, cookies have been removed from many
> applications due to security and privacy concerns.  Could you provide some
> more detail on what you are hearing from people about why they would prefer
> that cookies be used?  And how that is relevant to connection sharing?
>
> -Nick
>
>>

Re: URL sharing

[Nick Couchman <vn...@apache.org>]

On Mon, Oct 5, 2020 at 3:22 PM Antony Awaida <an...@apporto.com> wrote:

> Hi Guacamole team:
>
> I do realize that Guacamole used Cookies before V1.0. Can you please
> explain why Gucamole no longer uses cookies? Some users feel that sharing
> URLs may not be as secure without using cookies.
>
> Thoughts?
>
>
I believe that, in general, cookies have been removed from many
applications due to security and privacy concerns.  Could you provide some
more detail on what you are hearing from people about why they would prefer
that cookies be used?  And how that is relevant to connection sharing?

-Nick

>