Re: [http-state] Security considerations overview

[Adam Barth <[e-mail]>]

On Tue, Mar 2, 2010 at 1:46 PM, David Morris <[e-mail]> wrote:
> On Tue, 2 Mar 2010, Adam Barth wrote:
>> On Tue, Mar 2, 2010 at 11:42 AM, David Morris <[e-mail]> wrote:
>> > On Tue, 2 Mar 2010, Adam Barth wrote:
>> >>         <t>Transport-layer encryption, such as HTTPS, is insufficient to
>> >>         prevent a network attacker from altering a victim's cookies because
>> >>         the cookie protocol does not provide integrity.  By default, cookies
>> >>         are transmitted in the clear, where their confidentiality can be
>> >>         compromised by a network attacker.</t>
>> >
>> > I don't under stand how the second sentence extends the thought in the
>> > first sentence. It seems in conflict in the sense that HTTPS is not
>> > sending cookies in the clear and use of HTTPS is generally recommended
>> > as the way to avoid compromise by network hackers. What am I missing?
>>
>> If even if you use the cookie protocol exclusively over HTTPS, the
>> default is still to send the cookies in the clear (i.e., the
>> secure-only-flag defaults to false).
>
> But wrapped inside of the HTTPS stream, it is like the remainder of
> everything about the HTTP request (including headers), sans any general
> HTTPS vulnerabilities, not visible on the network to hackers.
>
> If you are trying to say that a cookie sent on an HTTPS connection from
> a server will be returned on any non-HTTPS connections and hence be
> vulnerable in that context, the paragraph doesn't say that. To me it
> says that even if my WHOLE application is HTTPS based, the cookies
> are vulnerable on the network.

Even if your whole application is HTTPS-based, the cookies are
vulnerabile to active network attackers.  That is a true statement,
and precisely the security problem we're trying to point out in that
sentence.  Maybe this is a better formulation?

[[
        In addition, by default,
        the cookie protocol does not provide confidentiality from network
        attackers.
]]

Adam