Timeline for Usability and CSRF tokens
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 11, 2015 at 0:54 | comment | added | Steve Dodier-Lazaro | See this question on our very site about CSRF and brute-forcing. I hope it clarifies. | |
| May 11, 2015 at 0:46 | comment | added | 1lastBr3ath | Yeah, I know what CSRF attack is, how it's exploited, and in what scenarios. That's what the point here is, you cannot make automated requests without obtaining the token, and if the token is changing or if you're being redirected twice, it's almost impossible to perform a brute-force attack, all due to the token. I'd be glad if you could just let me know the use of CSRF tokens in un-authenticated areas, like in this case. Edited: That's in case of authenticated areas :) | |
| May 11, 2015 at 0:39 | comment | added | Steve Dodier-Lazaro | That just doubles the amount of requests, but the time-complexity of a brute-force attack would remain unchanged. CSRF is a type of attack where I can cause users to submit a form on a third-party website (e.g. by creating a link to yourbank.com/sendmoney?to=me&amount=alot). The existence of a CSRF token forces me to first render that form to obtain the token. I won't be able to do so as your existing user session would not be available to me -- I'd need to have stolen your credentials already. See owasp.org/index.php/… | |
| May 11, 2015 at 0:34 | comment | added | 1lastBr3ath | Using random tokens at login page requires attackers to obtain the token accordingly, making it hard to automate the brute-force attack. Otherwise, I don't see the use of CSRF tokens in un-authenticated areas, and being able to logged into a victim's machine merely does any harm. | |
| May 11, 2015 at 0:28 | comment | added | Steve Dodier-Lazaro | Blargh, I'm mixing myself up too! My bad. CSRF tokens have to do with CSRF, and indeed do not help with XSS (they in fact can be defeated by XSS). I don't get what you meant by brute-force either though. | |
| May 11, 2015 at 0:26 | comment | added | 1lastBr3ath | OK! Thanks for the clarification, but I don't understand CSRF tokens being used to protect XSS. It would be nice if could provide me with references I can learn these from. | |
| May 11, 2015 at 0:01 | comment | added | Steve Dodier-Lazaro | Please, enough with the "security-usability" trade-off myth. The people who say that are the people who don't understand the concept of a design space. Besides CSRF have to do with XSS attacks and not brute-force. Finally the harm caused by marginal and uncommon CSRF token expirations will never be anywhere near the harm caused by having legitimate users fill CAPTCHAs. In general, if you feel the need to say things such as "I think", or "I believe" in your answer, it's best to take some time and learn more before you provide answers. Usability engineering is not a matter of opinion. | |
| May 10, 2015 at 23:53 | history | answered | 1lastBr3ath | CC BY-SA 3.0 |