Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Hello i want to know if this auth token is secure enough for a site of millions of logged in users:

BAQAAAT7Y/BHPAAaAAJ0AAaAKLZowMDAwMDAwMAFkAAJTii2aI2EACAAeUdCHGjEzNjk4NDUyOTl4MzIxMTMzOTcyMjA0eDEwMXgyWQAzAAlTii2aNjUwMTAsSVRBAMsAAVGpASIxABAADlOKLZpyb2JlcnRvcGFzc2VyaQBAAA5Tii2acm9iZXJ0b3Bhc3NlcmkA8wAiU4otmiQyJFA3enZoS2xTJGY5Ly9sUTRVcWNGQkJwd25DODE2ZDAAygAgWw77mmE1NmNiN2U5MTNlMGE1NjFjNTU2MDMwNmZmODRmOTMwAU0AGVOKLZo1MWExZGRmYS4xMDEuMS43LjQ2LjAuMC4yAAQADlODEWdyb2JlcnRvcGFzc2VyaQCcADhTii2ablkrc0haMlByQm1kajZ3Vm5ZK3NFWjJQckEyZGo2dvvv0Zrb0dsREpXS29RdWRqNng5blkrc2VRPT0BTAAaU4otmjUxYTYyZTMzLjEwMS4xLjMuMTAwLjEuMC4yreIRtwcAv5JgOcJxVKcOY7Jx1X0

With 10 million connected users how much hard is to guess a valid token?

Which features should it have? Consider that the content of the cookie travels up and down the server to each request so it can't be too easy

It is safe to set this cookie via HTTPS but read it in each HTTP page?

share|improve this question

1 Answer 1

So here's how this works: we tend to consider 128 bits of random data unguessable. See Why so long to break 128-bit encryption? for some talk about that.

What you want to do is calculate the birthday attack. There are some other questions talking about this in What are the chances to generate the same ssh key? and What is the collision chance of a 128-bit hashing function if it is always fed with 256-bits of data?.

Your token there looks like it's Base64 encoded, so it provides 6 bits per character. That's over 3,000 bits of data. Encode something smaller (128 bits raw, 170+ in B64) and save yourself the bandwidth.

For the second part of your question, see How is an HTTPS login secure when pages use HTTP?.

share|improve this answer
    
Truncated Base64 of some sort, at least. –  Steve May 31 '13 at 20:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.