222 reputation
16
bio website squirrel.pl/blog
location Krakow, Poland
age
visits member for 3 years, 1 month
seen Aug 4 '11 at 4:59

Quality nut. So disappointed with "good enough" and "I don't care I'm too busy chasing my tail".


Jul
22
awarded  Popular Question
Apr
27
awarded  Popular Question
Dec
11
awarded  Popular Question
Jun
30
awarded  Yearling
Aug
3
comment Using password hash as session ID?
Right. I wouldn't do it with browser-based client. I'm talking about a rich desktop client which does not really use HTTP. I know the difference between SSL and session management. Mentioned it only to prevent answers talking about channel security.
Jul
2
accepted What to transfer? Password or its hash?
Jul
1
accepted Using password hash as session ID?
Jul
1
comment Using password hash as session ID?
Anyway, the point about gaining permanent access and having more places to secure (not just one request handler) makes much sense.
Jul
1
comment Using password hash as session ID?
@mehaase Good points (both of them). I think my thick client with TLS is invulnerable to XSS. For a determined attacker, capturing one request is not much more difficult than capturing more of them (and that's not a problem with TLS).
Jul
1
awarded  Nice Question
Jun
30
comment Using password hash as session ID?
Right, and my question is: What exactly is insecure in using this specific kind of session key for secure channel? Is it only the fact that it's not temporal?
Jun
30
comment Using password hash as session ID?
Can you explain which assumptions are faulty? I agree they are very similar, but I don't think they have the same answer. Secure authentication over insecure channel is different from session maintenance over secure channel. What I'm trying to find here is whether having this kind of key is secure - the fact that it's static, as well as that it's directly related to password management.
Jun
30
comment Using password hash as session ID?
This is a good point, but... If they are able to install a trojan or keylogger on client, there's little difference between capturing a password on login and capturing the hash (or session ID) later.
Jun
30
comment Using password hash as session ID?
@AviD Right. I was replying to the "use a library for sessions" point. The main question is not how session works, but whether this kind of ID is secure.
Jun
30
comment Using password hash as session ID?
It's completely different. That one was whether It's better to send password or hash on authentication over an insecure channel. This one is about using password hash for identifying an open session over a secure channel. What are the possible risks? Should I avoid sending hash to client and using it this way?
Jun
30
comment Using password hash as session ID?
I don't care about one session per user. Hash is not the only user identifier - I also pass user ID for some other reasons. There's no cookies, it's a rich client. This is also the reason why reusing a session mechanism is more difficult. Replay attacks are just as possible with session ID. And I assume HTTPS is there.
Jun
30
awarded  Scholar
Jun
30
accepted Is it possible to secure a web app without HTTPS?
Jun
30
asked Using password hash as session ID?
Jun
30
awarded  Student