Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have this silly question that is bothering me. When not using secure connection (HTTP for example) cookies can be intercepted and used to connect to the site as if we have the id and password. We can protect against this by using secure connection (https). This assures that the cookies sent to the server are encrypted.

My question is: why can't an attacker use the encrypted cookies? Could an attacker intercept these cookies and send them to the server?

share|improve this question

3 Answers 3

up vote 8 down vote accepted

The reason why an attacker can't use the encrypted cookies is that HTTPS encrypts the entire HTTP conversation between client and server, not just the cookies. (Unless the attacker has managed to subvert the key exchange parts of the protocol, but that's a story for another question.)

For a fun exercise, use both Wireshark and your browser's debugger to watch the network traffic when you visit your favorite HTTPS site.

share|improve this answer
    
After I wrote my question this idea come to my mind thanks! –  user230137 May 19 at 7:14

Because you can't spot the cookies, and even if you could, you couldn't re-use them.

An actual HTTP request looks something like this, and the whole thing is encrypted:

GET /wiki/Main_Page HTTP/1.1
Host: en.wikipedia.org
Accept: text/html,application/xhtml+xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.57 Safari/537.36 OPR/18.0.1284.49
Referer: http://en.wikipedia.org/wiki/Main_Page
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8
Cookie: centralnotice_bucket=0-4.2; uls-previous-languages=%5B%22en%22%5D
Connection: keep-alive

Note that the cookie is mixed in with a whole bunch of other stuff. You can't grab an encrypted cookie because you can't find it (it's surrounded by stuff that varies from browser to browser and even request to request). Even if you could find it, SSL includes measures to prevent an attacker from re-sending a request (a replay attack), and it includes a message authentication code (MAC) to prevent an attacker from slicing up a request and only using part of it.

Further, SSL uses a different encryption key for each connection. Even if you could grab the encrypted cookies and bypass the MAC, you'd find they were encrypted with the wrong key for you to use them.

share|improve this answer
1  
and SSL doesn't use ECB block mode so even if you could find the cookie, it depends on the previous data what is actually sent, –  ratchet freak May 19 at 12:27

If someone could manage to get the cookie, by, say, managing to get the data straight from your browser or HR (perhaps by sitting down at your computer when you stand up and walk away), then they could certainly reuse your cookie and it would work.

An attacker can't see the cookies because https encrypts the entire http packet, and the cookie is sent as part of the packet.

Incidentally, another method attackers can use is to try and trick your browser into sending the cookie to the server over http. (Google sslstrip if you're interested in more details on the attack). To prevent this servers can mark a cookie with the "secure" flag which tells the browser to only transmit the cookie over a secure SSL connection.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.