Tag Info

New answers tagged

0

In short; A browser restart. However, not every browser implements the specification defined by the W3C the same way. a) Does anyone have any knowledge on how the Tier 1 open source browsers (Firefox, Chromium) handle the sessionStorage and whether the contents could be written to disk, even temporarily in the case of a browser crash? It makes no ...


1

As long as the data travels inside a properly configured SSL/TLS connections, there is no security issue regarding the increase amount of data sent through the internet, the only downside would be an increased load on your server. If you cannot trust local storage, then fetching the data from the server when it is required seems the best option from a ...


3

This advice is often given for Single Sign On (SSO) solutions. This is for a collection of systems, where a user only logs in once. The authentication of the user is handled by a central system called the identify provider. After login, two sessions are established with the requested system and with the identity provider itself. When visiting a new system ...


22

After a bit of searching, it seems some banks are giving this advice following an attack on a bank that allowed users or malicious websites to reuse persistent cookies after a user had logged out, allegedly because other browser tabs were left open on the site in question and so the browser had not cleared the cookies yet. The reason such a vulnerability ...


8

You do under the following conditions: Someone might access the computer after you do (like at a library) The HTTP response (of sensitive info) does not set the Cache-Control header properly Go to yourbank.com, and look at your account. Click logout. Click the back button. Do you see your account info? The correct HTTP header is: Cache-Control: ...


2

To quote directly: Only use inbuilt session management. Store secondary SSO / framework / custom session identifiers in native session object – do not send as additional headers or cookies. What this is saying is that, if you've got a secondary system which doesn't/can't use inbuilt sessions, you shouldn't send that second session token as a ...


1

I think that an HMAC provides little added security if the session ID is something that is hard to guess. For example, a long secure PRNG. But if the session ID is simple to guess then there is the risk of session hijacking. As the expressjs framework allows you to provide a session ID creation function that returns IDs with unknown security properties, an ...


0

I agree with monkeymagic's answer and assertion that "it's all about the data" and would definitely implement a secret token as Eric G suggested. You mentioned in a comment that SSN information is entered at some point so one additional step you can implement is to obscure any particularly sensitive information previously entered when a user resumes their ...


3

Answer 1: if the server uses SSL/HTTPS(verified by third party-not self-signed certificate), cookies and session IDs travel as cipher-text over the network, and if an attacker (Man in the Middle) uses a packet sniffer, they can not obtain any information. They can not decrypt data because the connection between client and server is secured by a verified ...


14

The connection between the client and the server does not use public key encryption (that is only used for the initial key exchange). A different algorithm is used for encryption (usually a symmetric encryption), such as AES-256-CBC on a TLS 1.2 connection. So unless you intercepted it, no one but the intended browser and the original server can decrypt the ...


0

I'm assuming the user logs in or proves who they are, and would not be anonymous and only providing an encryption key for authentication. It seems like it would be best to just periodically POST the answer to the server and store them in a HIPPA compliant way there. StackExchange temporarily stores your answers, so you could look and see how they are doing ...



Top 50 recent answers are included