Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user
17
votes
5answers
846 views
Can you secure a web app from FireSheep without using SSL?
Assume that you want to give some web users privileged access to your website, but that you are unable (or unwilling) to offer SSL to all of them - at least past the initial login page.
In this ...
15
votes
1answer
838 views
What cookie attacks are possible between computers in related DNS domains (*.example.com)?
Here, several servers in the same DNS domain emit cookies under a variety of settings (scope, HTTPS, Secure) and another host emits a cookie with the same value.
Example
Suppose a user has the ...
15
votes
4answers
2k views
How to hijack a session?
Despite the blatant title of the question, this is actually for a genuine purpose.
My site uses PHP code like this:
$select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'";
...
12
votes
6answers
525 views
Is This Login Security Enough?
I'm coming up with my next login system for admins of an ecommerce website to have
login form is SSL secured
password is converted to sha256 before being transmitted (bcrypt is too slow still for ...
12
votes
4answers
1k views
Why users want to disable cookies?
I just started to create a new web application. In the documentation, it is written that I have to prepare for the situation where users have disabled cookies. This is not the first time I have read ...
11
votes
5answers
634 views
Good session practices
What are some good practices for ensuring logins, session IDs and session content are secure for a website?
10
votes
3answers
3k views
How does FaceNiff work?
FaceNiff is an Android app that sniffs Facebook session ids. You must be connected to the same WiFi as the victim. It is said to be working even when WPA2 is present. How is it possible? I can decrypt ...
10
votes
3answers
1k views
What risks do Cookieless sessions have? What are the mitigations?
I'm debating if I should support cookieless sessions in my web app. It would look something like this:
http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx
Since the URL is never ...
9
votes
4answers
902 views
Demystifying Web Authentication (Stateless Session Cookies)
I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages.
Here is my first ...
9
votes
4answers
2k views
Session Hijacking - regenerate session ID
Does regenerating the session ID on each request mitigate the probability of a session hijack enough to be worth implementing?
I would imagine combining a check for REMOTE_ADDR vs the REMOTE_ADDR ...
7
votes
5answers
838 views
What do the various browser “private modes” do?
Recently there has been some disagreement as to what "private mode" means when it comes to various browsers.
Primarily I am referring to...
IE's "InPrivate Browsing"
Google Chrome's "Incognito ...
7
votes
5answers
344 views
Should a user have the ability to be logged in from multiple locations at the same time?
In the past, I've always used a single session per user setup, but I'm working on a project now where a user can be signed in from multiple locations/browsers at the same time.
What are the security ...
7
votes
2answers
668 views
Keeping user session alive - security considerations
We have recently developed some functionality for our web app to allow a user to remain logged in indefinitely, and are interested in knowing the security ramifications of doing so. The goal of this ...
6
votes
3answers
896 views
CSRF cookie vs session based tokens
I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie.
Is it ...
6
votes
1answer
2k views
Is windows 7 vulnerable to null session?
My lecturer told me that Windows 7 is not vulnerable to null session but did not explain why. What is the preventive measure that windows 7 did to protect against from it?
The recommend fixes for ...
5
votes
4answers
689 views
Using password hash as session ID?
For a rich client web app, on the server I need to verify that each call comes from a legally logged in user. Obviously user ID is not enough, because that's easy to guess.
I have an idea I am ...
5
votes
3answers
267 views
Is randomizing cookie names a good idea?
What security benefits would randomizing cookie names on a website offer? What are some of the challenges it would create?
5
votes
2answers
158 views
What are the tradeoffs in allowing logouts of other logged-in sessions?
For instance, Gmail has allowed remote logout since 2008. I think I have seen other sites that allow you to log out all other logged-in sessions.
What are the tradeoffs to consider in this session ...
5
votes
3answers
556 views
How do I protect myself against 'hole 196'?
I came across this question a while ago and read about hole 196.
Is there something I can install on my laptop to protect it against WPA2 Hole196?
Software (such as Snort or DecaffeintID) can ...
4
votes
4answers
929 views
Is it correct to use form field(hidden) for storing Session Token
Is it correct to use form field(hidden) for storing Session Token instead of using Cookies? What is the security risk associated with it?
4
votes
2answers
720 views
Are PHP Sessions based on cookies or a cookie-IP pair?
I have a PHP website and my question is:
If someone manages to steal my users' cookies via an XSS attack,
is it enough for him to be identified as the user?
Or does his IP also have to be the same as ...
4
votes
1answer
200 views
Two generals' agreement
I am trying to figure an agreement protocol on an unreliable channel. Basically two parties (A and B) have to agree to do something, so it's the two generals' problem.
Since there is no bullet-proof ...
4
votes
2answers
265 views
Attack vectors in POSTing variables from one php script to the next?
I have an application which is structured in the following way for its signup page. After this signup, the user is directly granted access into the system - there is no email verification (as ...
4
votes
2answers
168 views
Any real world examples of GPS location data being used with authentication?
Are there any examples of how GPS coordinate (or any location data really) can be used to detect suspicious locations or validate well known locations?
Specifically
Highlighting new or unusual ...
4
votes
3answers
116 views
Getting automatically logged in to others session via WIFI
Recently i got a very strange behavior on our WIFI network: We share a WIFI network with a simple router. One of us pays the bills and he's the one, who got the management account from our ISP. So if ...
4
votes
2answers
350 views
Deciding whether user has left the site without logging out or has simply left the site open for notifications without actually doing any work?
I am developing my site using server side sessions using redis as backend for saving the session.
Now the issue which is bothering me is of user leaving the website without logging out.
I mean user ...
4
votes
2answers
164 views
What factors increase the probability of duplicating a GUID?
It's been argued that a GUID doesn't do a good job of being a one time security token , and it makes sense because GUIDs aren't random.
In my scenario: suppose a given company is using GUIDs as a ...
4
votes
1answer
472 views
Is this admin area secure enough? V2
This is a response to my previous question, Is this admin area secure enough?.
There were some very helpful answers there, for which I am very grateful. So I went back to the drawing board and here ...
4
votes
2answers
301 views
Best way to securely set a session cookie on another domain
We currently have 2 sites http://www.foo.co.uk and https://secure.foo.com.
The www site does not have an SSL certificate and is on a different domain.
We have a login button on http://www.foo.co.uk ...
4
votes
1answer
1k views
OAuth access token vs session key
Is there any advantage to OAuth vs cookie-based sessions (established via username/password) under the following assumptions?
There is only one legitimate client to the service
The OAuth client ...
4
votes
1answer
240 views
A Secure Cookie Protocol
As title says I'm trying to implement a secure cookie protocol
HMAC(username|expiration name|data|session key, sk)
It seams that session key is not constant during whole application session ...
4
votes
0answers
110 views
Webapp2 security
I am coding a REST web application that runs on Google App Engine, it authenticates API requests to privileged data using sessions by cookies provided by webapp2_extras.auth and ...
3
votes
3answers
317 views
Is this admin area secure enough?
EDIT: Please view the revised question instead
The admin area has special access to the database (modifying orders, etc).
To help explain, I drew a diagram, so here is my process:
Notes:
I ...
3
votes
3answers
1k views
Do you need to encrypt session data?
I came across a session management class in PHP which encrypts session data in the session storage folder (i.e., /tmp) and can be decrypted later in your script using a key. I was wondering if it's ...
3
votes
4answers
370 views
Is this non-cookie based session scheme horribly vulnerable to some attack?
I am working on a large web application that runs entirely within a single web-page. For various reasons we do not want to use cookies in this web application, at all, but we need to keep track of ...
3
votes
3answers
776 views
Altering a $_SESSION variable in PHP via XSS?
Not sure if what I'm saying makes sense... but is it possible for me to alter a $_SESSION variable from outside the target PHP script?
One of our scripts uses a $_SESSION variable and I'm not sure if ...
3
votes
4answers
171 views
Securing opensource web application
I have an open source website. I need to add an admin section to the website which is accessible to only one person. To make it secure, I was thinking about providing a login page which checks if the ...
3
votes
3answers
590 views
Choosing a session ID algorithm for a client-server relationship
I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
3
votes
1answer
809 views
Will session_regenerate_id() without true parameter improves security? Should I use it right before login?
I want to decrease session fixation attack vulnerability, hence I used session_regenerate_id() before login. Somehow I'm in dark now and not sure the right answer for questions below:
When we ...
3
votes
1answer
130 views
Session Token Embedded in Form
I have a session token that's stored in a browser cookie client side. The cookie is already available for scripting and it's used to validate XHR through Javascript. For a particular page I'm using ...
3
votes
3answers
132 views
Does the ability for a user to choose the value of a session id cookie constitute a security flaw?
In the context of a web application, a user connects to this application and a session id cookie is set to authenticate the user for next requests. As the cookie is actually present before submitting ...
3
votes
1answer
143 views
Security of rails user access/permissions plugins
I was wondering if anyone knows what the most secure user access plugin for Rails is, and if any of them prevent session fixation?
3
votes
1answer
348 views
Where and How is data stored in a session?
Where is the information in the fields of a session stored? If I, for instance, store in a session something like $_SESSION['foo'] = 'bar'. Where is "bar" stored?
If I store an object of a class, in ...
3
votes
1answer
252 views
OpenID Session Fixation with CSRF
This answer describes a situation where CSRF can be used to trick an end user to enter a credit card into another person's Paypal account. It also highlights the fact that state-changing GET requests ...
3
votes
1answer
70 views
Session Cookie Stealing Protection
I am looking at how to secure a web site against getting its session cookie stolen. These are the controls that I know are widely known/used:
HTTPS Everywhere
Only use a securely created random ...
2
votes
3answers
104 views
Can I safely use an encrypted URL parameter for the session id?
I'm planning to send a user's session ID as a URL parameter which will be AES encrypted. I don't think my app has any link sharing problems. Is this idea feasible? Is it safe?
2
votes
4answers
655 views
Can a session be hijacked if the user is redirected from HTTPS to HTTP after login?
I am developing a web app, which makes HTTP calls as long as the user is not logged in.
Once the user clicks the login button, he is sent to a "login page" that is HTTPS.
The login makes an Ajax call ...
2
votes
3answers
150 views
Secure login system - using sessions?
I'm looking for a secure way to let users login on my website. Currently, I've always used a session system, like this:
<?php
session_start();
if (validPass() || isset($_SESSION['userId'])) {
...
2
votes
4answers
264 views
When logging out of a website is anything else required then destroying the session?
In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out.
session_start();
session_destroy();
Is there anything else that needs to be done?
EDIT: I ...
2
votes
2answers
148 views
How attacker can access victim's account without knowing its credentials?
I want to login facebook from a wifi connection and check sign-in page is over https but later when i don't pay attention to address bar (for example when playing games and click on links like a crazy ...
