15

We are developing a web application that will use two factor authentication. We are likely to try and emulate something similar to that used by google, where to login you enter a username and password, and then receive a token in an SMS message to be entered as well.

We would like to allow users to remember a client machine if they would like to so that they can login for 30 days without requiring the second authentication method. What information will we have access to (through headers of the web page requests etc.) which we can use to uniquely identify this trusted client machine?

Obviously a user can have more than one trusted client machine, and I completely expect that if they use two different browsers on the same trusted machine machine, each browser will have to be trusted independently.

Setting a cookie on the machine with some GUID which means this is trusted simply would not be good enough, as someone else could just copy the cookie, and create it on their own browser circumventing the two factor authentication.

Improve this question

3 Answers 3

Reset to default
11

I don't think that it is entirely possible with just JavaScript/PHP (or some other server side language) to uniquely imprint/identify a computer.

Remember, whatever you do, someone with malicious intent can just copy the Chrome/Firefox user data directory to a similar system (same OS, etc). Indeed, that's the easiest thing to do, since you don't have to hunt for the cookies. JavaScript can't read anything outside these directories, so they have just duplicated the system.

However, you can use Flash/JavaScript to fingerprint the browser. Unfortunately, the browser fingerprint can change if the user installs fonts/etc. Besides, your users will have to allow the Flash/JavaScript to run -- nowadays quite a few people are disabling JavaScript due to the recent 0 Day exploit. You don't want to force your users to have to use these. Anyway, one can easily replicate a fingerprint by replicating the system (which takes time, but isn't too hard).

In the end, two factor auth is all about (a) having a password, and (b) having physical access to a device. If you are giving someone unsupervised access to your computer while logged in as you, part (b) is compromised anyway, in a different manner.

To answer your question, though:

  • You can put a unique GUID in a cookie
  • You can put another GUID in localStorage
  • You can associate part of the browser User-Agent request header with the account. For example, my User Agent is User-Agent:Mozilla/5.0 (X11; Linux i686) AppleWebKit/536.11 (KHTML, like Gecko) Ubuntu/12.04 Chromium/20.0.1132.47 Chrome/20.0.1132.47 Safari/536.11. From here, you can extract my browser name (which won't change), OS name and version (which will change occasionally), whether or not my computer is 32 bit, etc.
  • navigator.plugins -- This is an array of all the plugins installed on the browser. Maybe not a good idea for 2 factor authentication, though, since this changes often.

Note that all of these can be easily spoofed. It's just extra hoops for a would-be hacker to jump through.

Again, you can try using fingerprinting techniques that deal with reading the list of installed fonts, etc. Again, this can be circumvented, but it's much harder. You can also use JavaScript to store cookie-like files in random places on the computer (not sure if that's a good idea)

Edit: As Joel mentions in the comments, you should also have a way of revoking "trusted computers" (simply dissociate the GUID in your database). And this should apply when the password is changed as well.

Improve this answer
6
  • Thanks. I know it won't be perfect, and I don't mind if we ask too often (just means someone will need their mobile phone). I wonder what Google actually use for their stuff.
    – Marryat
    Feb 22, 2013 at 14:45
  • @Marryat: They probably use a cookie. It's up to the end user to keep their computer safe. Like I said, if you give someone unsupervised access to your computer, part (b) is anyway compromised. Two factor authentication is really supposed to stop keyloggers in public pcs from getting you, if someone has access to your computer and has your password, the account is gone anyway :s
    – Manishearth
    Feb 22, 2013 at 14:54
  • 7
    There is really no point in using anything other than a cookie with a long random identifier. If the attacker has access to a machine, they'll be able to extract any other information anyway. Plus, if you use something like navigator.plugins or the User-Agent string, then the attacker can simply direct the user to his own site (via, for example, a phishing email) and extract the same information; but the attacker can't extract the cookie information that way.
    – Joel L
    Feb 22, 2013 at 14:54
  • 1
    Google also has a way to revoke all "remembered computers", so if my machine is compromised or stolen, I can revoke access. You should also automatically revoke all authorized computers if the user password is changed.
    – Joel L
    Feb 22, 2013 at 14:55
  • @JoelL: Exactly, that's why I put up the whole "it's impossible" paragraph in the first half of the answer :P
    – Manishearth
    Feb 22, 2013 at 14:56
1

Don't think this can be done safely for an arbitrary client using only a standard web browser. As you say, cookies are not a safe choice to authorise a computer. Besides, cookies are set per browser, not per computer. You could try browser fingerprinting techniques, but again this is specific to the browser, not the computer. And keep in mind that HTTP requests, including User Agent strings, can be set arbitrarily by a malicious client.

Improve this answer
0

You can also encrypt the user's IP address in the cookie when you issue the cookie, then from then on compare the IP address in the cookie with the one in the incoming HTTP request. Of course, this will break when an ISP changes a consumer's dynamic IP address, but that doesn't happen too often.

Improve this answer
1
  • An IP address is not synonymous with a machine though. It's going to change when you move a machine from network to network, for instance if I phone switches between WiFi and mobile data, or as a laptop moves from home, to a coffee shop, to the office.
    – Xander
    Oct 9, 2020 at 0:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .