Timeline for Session cookie security
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 8, 2022 at 11:13 | vote | accept | Mah Neh | ||
| May 8, 2022 at 11:11 | comment | added | Mah Neh | Yes I was rounding up by billions..Thanks for the calculation @CBHacking. Very interesting. I will ask for help. Actually, I don't want to do any of that, but I don't want to accept procedures without some reasoning. This is quite enlightening too developer.mozilla.org/en-US/docs/Web/HTTP/Cookies | |
| May 8, 2022 at 11:10 | comment | added | CBHacking | @MahNeh Well, first I'm curious where you plan to find two billion sessions for every human being alive, what database you're planning to store them in, and how long your system plans to spend generating them. But suppose they do exist anyhow, and you want to guess one. Say you have a gigabit connection, and a minimal valid request is 50 bytes (400 bits). That's 2.5 million attempts per second, max. At that rate, you can try 2^64 possibilities in a mere 233817 years. Better get going! | |
| May 8, 2022 at 10:37 | comment | added | Mah Neh | 2^128 times to get all possible combinations. Fine. The chance is the number of session ids times that number. If there are 2^64 created session IDs, then the chance to guess one is 2^(-64). I am not sure how many a powerful computer could try per second..@CBHacking | |
| May 8, 2022 at 10:25 | comment | added | Mah Neh | Ok once it is done i would be glad to see if either of you can crack it. It's an extremely small app to chat with friends (i am not a programmer). @CBHacking | |
| May 8, 2022 at 10:18 | comment | added | CBHacking | @MahNeh if an attacker can do that, your session tokens are waaaaaaaaay too weak. Suppose you're using a 128-bit (entropy, not necessarily length) token, a common strength. Further suppose that not just one person, but every user, is attacking it (birthday attack). "A couple millions" is 2^21. You'd need roughly 2^53 users - about 8 quadrillion, or roughly a million times as many people as exist on the planet - all attacking each other millions of times - before, statistically, one would ever find another's session. But if that's too risky, you can use 256 bits of entropy instead. | |
| May 8, 2022 at 10:16 | comment | added | Steffen Ullrich | @MahNeh: Assuming proper session cookies which contain sufficient randomness such a brute force is not feasible. Even when assuming that one could try 100.000 session ids in a second (probably unrealistic) it would take many years to brute force even 6 bytes (48 bit - not the same as 8 alphanumeric characters!) of randomness. | |
| May 8, 2022 at 10:03 | comment | added | Mah Neh | Wouldn't it be easy though, to try a couple of millions session ids (with the software I mentioned) and get information from users? Seems extremely possible to me given the long expiration dates + number of users of some apps... | |
| May 8, 2022 at 9:54 | comment | added | Mah Neh | thank you, i always forget what is not encrypted in https. I know that IPs source and dest are not, and some other details...sorry that i can not upvote score less than 15. will likely accept if no better answer is given. | |
| May 8, 2022 at 9:39 | history | answered | Steffen Ullrich | CC BY-SA 4.0 |