Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

Often when an account is hacked, security guidance is to change your password. However I've noticed that changing a password sometimes isn't enough to log out of other sessions that are active.

  • Is there any formal security guidance that recommends or requires that all logon sessions are expired and must be re-authenticated? This could be industry specific, or from a respected government or private company that publishes similar guidance.
share|improve this question
Your password is used when you authenticate only. Cookies take it from threre. Changing your password does not change your cookies. You can clear your cookies, but the attacker who logged in with your old password won't :) – ixe013 Nov 28 '12 at 16:18
1  
@ixe013 I updated the question to only focus on "formal guidance". However, it is technically possible for the server to invalidate other sessions and issue a new session token. – makerofthings7 Nov 28 '12 at 16:29
I don't know about a formal guidance, but a server could add a something like a version, like a counter or a timestamp, to the authentication cookie. So when a request comes in, the server would : 1. Decrypt the cookie or verify that it was not tampered with 1. Read the password version or timestamp that was valid when the cookie was generated 1. If the password version or timestamp is older, prompt for authentication again. This might be harder to do in other environments. For example, a Kerberos ticket held by an attacker will stay valid after you reset your password. On the web, GMail has t – ixe013 Nov 28 '12 at 17:36
1  
@ixe013 You're assuming a lot about the OP's environment that isn't necessarily true. He might not be using cookie's to store session state. He might not even be talking about HTTP at all. – mehaase Nov 29 '12 at 5:00
Very true, @mehaase. I have updated my answer below to mention its limits. – ixe013 Nov 29 '12 at 14:08

1 Answer

up vote 1 down vote

OWASP cover this in the top 10 (2010) under "Broken Authentication and Session Management". The closest statement probably is that it mentions that sessions should be regenerated upon successful authentication of privilege change coupled with Session Timeout session fixation attack prevention. That's about as close to a standard as you will get.

Other standards such as ISF SOGP etc are too high level to cover this.

share|improve this answer
This prevents an attacker from getting a valid session cookie, maybe by starting a registration process, and forcing you to authenticate using that session cookie. The attacker does not have the password, but is valid session cookie is now authenticated. Asking the old password when you change your original password prevents further damages. – ixe013 Nov 28 '12 at 17:39
it's certainly worth taking this particular use case to OWASP and get them to include it in their top 10 notes. – Callum Wilson Nov 29 '12 at 12:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.