0

Would it be secure to:

  1. Store all my website cookies (stack sites, webhost, github, web-based email, etc) on a remote server (using an customized open-source VPN or something)
  2. Login to the server with password + 2fa (and maybe have a trusted devices list?)
  3. Keep the cookies only on the server... never actually download them to any of my devices
  4. When visiting stackexchange.com, for example, my server would send the cookies to stack exchange, get the response, and send it back to me, but REMOVE any cookies & store them only on my server

Benefits (I think):

  1. I could keep diverse and very strong passwords for every website, but don't store the passwords anywhere digitally (keep them on paper in a safe at home or something)
  2. logging in to all the sites I use on a new device only requires one sign in (to my custom VPN server)
  3. Only cookies would be stored digitally, so if anything went wrong server-side, my passwords would be safe & I could disable all the logins through each site's web-interface

Problems (I think):

  1. If the authentication to my custom VPN is cracked, then every website I've logged into would be accessible
  2. The time & energy & learning required to set something like this up.

Improvement idea:

  1. When I sign in to the server the first time, the server creates an encryption key, encrypts all the cookies with it, and sends the encryption key to me as a cookie. Then on every request, my browser uploads the key, the website's cookie is decrypted, then the request is made to whatever website I'm visiting. Then only one client could be logged in at a time (unless the encryption cookie were stolen)
  2. Encrypt each cookie with a simple password, short password or pin number
  3. An encryption key that updates daily (somehow)
  4. Keep a remote list of trusted devices, identified by IP address? Or maybe by cookie?

Why not just sign into the browser and sync cookies across devices?

  • Signing into Firefox mobile & Firefox on my computer doesn't give the cookies to Twitter's or Facebook's web-browsers (that frustratingly always open first instead of taking me to my actual browser!)
  • It's not as cool?
  • That would require me to trust a third-party (of course, I'll ultimately have to trust my web-host to some extent)
3
  • 2
    This sounds much more like an HTTP proxy rather than a VPN, since it works at the application layer. – multithr3at3d Aug 23 '20 at 17:12
  • 1
    Also, you should be able to disable those in-app webviews – multithr3at3d Aug 23 '20 at 17:16
  • 1
    Cookies might be device dependent, i.e. specific to browser fingerprint, connected with some local storage in the browser etc. Such mechanism are also used to prevent misuse of cookies in case it was stolen. And note that you also need to do SSL interception since otherwise your server would not be able to replace the cookies for HTTPS connections. – Steffen Ullrich Aug 23 '20 at 17:20
3

No, it won't be any practical nor solve anything.

First, there are cookies set or read from Javascript. Those cookies won't be stored on the server and will be different on each device. Every site using them will fail somehow. Sites that store the browser on a session variable will detect that your cookie was used with Firefox mobile and desktop, and may lock your session or password for suspected session hijack.

Second, it increases the complexity considerably, without any benefit. Having a custom VPN on each device is costly, both on speed and on battery consumption. Using a proxy on the server would be simpler, but will reduce speed as well.

Third, you will have to install a custom CA on each device, intercept the SSL connection server-side, create a certificate on-fly and encrypt the connection with the generated certificate before sending to the client. This is a huge issue if someone hacks into the server (more on this later).

Lastly, you will have to maintain a backend infrastructure to store and manage every cookie, and write a custom process to check every HTTP header, strip all cookies, store them securely, and send to the client. On the other side, you will have to intercept every connection from every client, search for cookies, alter the request, and add the cookies.

I could keep diverse and very strong passwords for every website

You would better use a password manager for that.

logging in to all the sites I use on a new device only requires one sign in

With a password manager, one keystroke will login you back.

If the authentication to my custom VPN is cracked, then every website I've logged into would be accessible

Only cookies would be stored digitally, so if anything went wrong server-side, my passwords would be safe

Not even close. The cookies are the least of your problems. If something goes wrong server-side (like an attacker compromising it), the attacker will be in position to MitM every single HTTP/HTTPS connection you have. They have the private key of your custom, trusted CA, and can create valid certificates for everything. A custom CA enables you (and the attacker also) to bypass HSTS validation, so even websites protected by HSTS will be able to be attacked.

Imagine downloading a driver for any device you have, and the attacker changing the download on-fly to embed a root-level backdoor and keep the device signed. Or going to your bank to transfer money to someone, and the attacker changing server-side all transfer details but keeping the client-side unchanged, so you put the destination account on the form, read the confirmation page with the correct destination, press "Confirm" to send the money, read the confirmation page with the correct details, but server-side the attacker wired the money somewhere else. And that is possible because of the custom CA and the interception proxy.

They will have access to every single website you already accessed, and have access to every single website you access from that point on, being able to read and change anything at will. And be able to even change sites that you never accessed before, even when you don't use your custom proxy.

How? HTTP Caching. He can backdoor, for example, https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.js or https://code.jquery.com/jquery-3.5.1.js and put a very long expiration date. As soon as your browser cache this backdoored version, it does not matter if you are using the proxy or not, every site that uses this CDN version of JQuery can be compromised.

It's not as cool?

For me, looks like a disaster waiting to happen...

0

Your "cookie proxy" is an interesting idea. I could see perhaps some tightly-defined use cases for this, but I think in general you may run into some hurdles that may make it more effort than it is worth.

First of all, where will the cookies come from? You will have to manually log into the sites at some point from one of your devices using your passwords, in order for them to be saved to your server. This could be scripted for each site, but that's a huge manual effort. Second, there is no standard for how long cookies last; the system will do you no good for websites that have very short-lived session cookies, as you may need to re-enter your password possibly after as little as 15 minutes. You also are assuming they are set by the server rather than on the client side. Or, the application could even be using other client side storage besides cookies.

As far as security goes, this doesn't really save you if one of your devices is compromised. In this case, the credentials for your system could be stolen, or your device could be forced to make authenticated requests to sites on your behalf using the "cookie proxy".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.