2

This question concerns the type of 2-factor authentication implemented by Google Accounts.

The response to this question describes securing transfer of the secret key via a secure cookie.

But what if the adversary can execute remote code on your machine? If they can copy the cookie off your machine, this still leaves a gaping hole. If they send it to themselves, couldn't they access your account at a later date?

Is it possible to implement a login system that protects against this scenario, while still allowing your user the convenience of "Remember this computer for 30 days"?

2

Yes it is possible.

If tokens are server generated by creating a cryptographically secure random sequence stored against the account, this token could be refreshed and reissued on a certain interval, invalidating the old one.

The token would only be refreshed on active use so it won't invalidate the old one when the client computer is off. This approach ensures that a copied cookie only has a limited time to be reused, limiting exposure of the attack. In the case that the attacker uses the cookie in time, the original session would be expired and the real user would be logged out (depending on how the interval is set). A message could be displayed that the account is being used elsewhere, alerting the user to the attack.

If the attacker has persistent access though and can grab any new identifiers, she has already won. The above only protects against a one time theft of the token. For example if the user left their screen unlocked and the attacker had physical access and only enough time to steal the cookie value, or if the value was stolen via a reflected XSS attack, which is code execution in the browser, and the attack cannot be repeated easily.

An attacker with root access though may or may not be able to grab a normal user's cookie. Chrome encrypts cookies when saved to disk, allowing only the current user to decrypt them as the key is derived from their password. Therefore an attack on tokens in cookies would be more difficult.

1

Is it possible to implement a login system that protects against this scenario, while still allowing your user the convenience of "Remember this computer for 30 days"?

No. To put it bluntly, it is impossible. That will be a huge, complicated and simply a non feasible task for an authentication system to fulfill.

All what you can do is to be careful of the vulnerabilities that may your software, operating system and network settings suffer from, and think how to protect yourself from eventual vulnerabilities and mitigate the threats on different levels of the layered security mechanism:

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.