Re: [http-state] Security considerations overview

[Tyler Close <[e-mail]>]

On Tue, Mar 2, 2010 at 1:54 PM, Adam Barth <[e-mail]> wrote:
> On Tue, Mar 2, 2010 at 1:46 PM, David Morris <[e-mail]> wrote:
>> On Tue, 2 Mar 2010, Adam Barth wrote:
>>> On Tue, Mar 2, 2010 at 11:42 AM, David Morris <[e-mail]> wrote:
>>> > On Tue, 2 Mar 2010, Adam Barth wrote:
>>> >>         <t>Transport-layer encryption, such as HTTPS, is insufficient to
>>> >>         prevent a network attacker from altering a victim's cookies because
>>> >>         the cookie protocol does not provide integrity.  By default, cookies
>>> >>         are transmitted in the clear, where their confidentiality can be
>>> >>         compromised by a network attacker.</t>
>>> >
>>> > I don't under stand how the second sentence extends the thought in the
>>> > first sentence. It seems in conflict in the sense that HTTPS is not
>>> > sending cookies in the clear and use of HTTPS is generally recommended
>>> > as the way to avoid compromise by network hackers. What am I missing?
>>>
>>> If even if you use the cookie protocol exclusively over HTTPS, the
>>> default is still to send the cookies in the clear (i.e., the
>>> secure-only-flag defaults to false).
>>
>> But wrapped inside of the HTTPS stream, it is like the remainder of
>> everything about the HTTP request (including headers), sans any general
>> HTTPS vulnerabilities, not visible on the network to hackers.
>>
>> If you are trying to say that a cookie sent on an HTTPS connection from
>> a server will be returned on any non-HTTPS connections and hence be
>> vulnerable in that context, the paragraph doesn't say that. To me it
>> says that even if my WHOLE application is HTTPS based, the cookies
>> are vulnerable on the network.
>
> Even if your whole application is HTTPS-based, the cookies are
> vulnerabile to active network attackers.  That is a true statement,
> and precisely the security problem we're trying to point out in that
> sentence.  Maybe this is a better formulation?
>
> [[
>        In addition, by default,
>        the cookie protocol does not provide confidentiality from network
>        attackers.
> ]]

A reader could again misinterpret that formulation and so believe the
problem can be fixed by using HTTPS, which is incorrect.

I think this thread is a good indication that providing an "executive
summary" at the start of the Security section could be very effective
in communicating the rationale behind the prior recommendation against
using cookies in new applications. Succinct statements can sometimes
communicate better than detailed descriptions.

--Tyler

-- 
"Waterken News: Capability security on the Web"
http://waterken.sourceforge.net/recent.html