Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am looking for the best approach to recognizing a specific computer and saving that computer as a "safe" login machine. My intuition points me to using cookies, but what value do I store in there to make sure it's safe? What data do I cross-reference to make sure that cookie wasn't stolen off of another computer?

Some examples of what I am trying to accomplish are the websites of major banking institutions, such as Chase, Bank of America, etc. They seem to remember if a computer is accessing the site for the first time.

I may have stated this problem strangely, but I don't know of any other way to describe it--maybe someone can chime in with the correct security terminology for this technique. Although I'm relatively new to security, I am willing to learn!

Thanks

share|improve this question

2 Answers 2

up vote 4 down vote accepted

I'm not certain specifically what methods the banks you listed use for this, but I would do a combination of many things, mostly server side and stored in a database.

Disclaimer: Not any one of these things are by any means fool proof.

  • User agent
  • First and second octet of IP Address (may not be feasible with dynamic IP, this is still processing in my head)
  • Average days of week/time of day user logs in
  • Browser cookie containing a random token

These things create a signature of the typical environment a user logs in from. When that changes, we prompt for an additional authentication item.

When a user logs in and one or more of those fields stored in the database doesn't match, I would prompt for the secret phrase, or whatever field you use.

I'm sure there are other ways, and other fields you can store to compare against, these are just a quick few that came to mind.

share|improve this answer
    
At first, having historical IP data was an idea for me as well, until thinking about the nuances of dynamic IPs clouded my mind.. –  danyim Jan 31 '12 at 22:00
2  
+1 Banks do typically use these things you listed at some point in the transaction chain. The cookie is always the primary login instrument as it is the only one that behaves predictably, but a fingerprinting system based on device profile (which can include much more information gathered client-side than just the User-Agent header) combining with behavioural pattern analysis is likely to flag unusual traffic and subject it to re-authentication. –  bobince Jan 31 '12 at 23:04

What some large banks are doing is using products like Trusteer's Rapport - which provides an agent to the user's machine which carries out the confirmation that the machine is 'safe' and hasn't been to any known malicious websites.

There are other commercial, and home-grown agent-based solutions to this problem, but all they do is make the spoofing part of an attack harder.

Many banks do already carry out statistical analysis on network traffic, and not just on payment traffic, in order to more rapidly identify potential fraud, but this isn't so much to identify a particular computer, but to identify behavioural anomalies.

share|improve this answer
    
Thank you for the answer and the link. We may have to consider commercial options, but for now I think we'll try the homebrew solution first. –  danyim Feb 2 '12 at 14:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.