meta user
network profile
| bio | website | squirrel.pl/blog |
|---|---|---|
| location | Krakow, Poland | |
| age | ||
| visits | member for | 1 year, 11 months |
| seen | Aug 4 '11 at 4:59 | |
| stats | profile views | 9 |
Quality nut. So disappointed with "good enough" and "I don't care I'm too busy chasing my tail".
|
Jun 30 |
awarded | Yearling |
|
Aug 3 |
comment |
Using password hash as session ID? Right. I wouldn't do it with browser-based client. I'm talking about a rich desktop client which does not really use HTTP. I know the difference between SSL and session management. Mentioned it only to prevent answers talking about channel security. |
|
Jul 2 |
accepted | What to transfer? Password or its hash? |
|
Jul 1 |
accepted | Using password hash as session ID? |
|
Jul 1 |
comment |
Using password hash as session ID? Anyway, the point about gaining permanent access and having more places to secure (not just one request handler) makes much sense. |
|
Jul 1 |
comment |
Using password hash as session ID? @mehaase Good points (both of them). I think my thick client with TLS is invulnerable to XSS. For a determined attacker, capturing one request is not much more difficult than capturing more of them (and that's not a problem with TLS). |
|
Jul 1 |
awarded | Nice Question |
|
Jun 30 |
comment |
Using password hash as session ID? Right, and my question is: What exactly is insecure in using this specific kind of session key for secure channel? Is it only the fact that it's not temporal? |
|
Jun 30 |
comment |
Using password hash as session ID? Can you explain which assumptions are faulty? I agree they are very similar, but I don't think they have the same answer. Secure authentication over insecure channel is different from session maintenance over secure channel. What I'm trying to find here is whether having this kind of key is secure - the fact that it's static, as well as that it's directly related to password management. |
|
Jun 30 |
comment |
Using password hash as session ID? This is a good point, but... If they are able to install a trojan or keylogger on client, there's little difference between capturing a password on login and capturing the hash (or session ID) later. |
|
Jun 30 |
comment |
Using password hash as session ID? @AviD Right. I was replying to the "use a library for sessions" point. The main question is not how session works, but whether this kind of ID is secure. |
|
Jun 30 |
comment |
Using password hash as session ID? It's completely different. That one was whether It's better to send password or hash on authentication over an insecure channel. This one is about using password hash for identifying an open session over a secure channel. What are the possible risks? Should I avoid sending hash to client and using it this way? |
|
Jun 30 |
comment |
Using password hash as session ID? I don't care about one session per user. Hash is not the only user identifier - I also pass user ID for some other reasons. There's no cookies, it's a rich client. This is also the reason why reusing a session mechanism is more difficult. Replay attacks are just as possible with session ID. And I assume HTTPS is there. |
|
Jun 30 |
awarded | Scholar |
|
Jun 30 |
accepted | Is it possible to secure a web app without HTTPS? |
|
Jun 30 |
asked | Using password hash as session ID? |
|
Jun 30 |
awarded | Student |
|
Jun 30 |
asked | What to transfer? Password or its hash? |
|
Jun 30 |
asked | Is it possible to secure a web app without HTTPS? |
