Re: [http-state] Cookie login security inconsistency

Shelby,

Sorry for jumping into this so late.  I've been rather busy with other
things.

I read through the material posted.  In general, I do agree that cookies, as
they are defined today, are horrible as a means for managing session state.
Not only can they be snatched off the wire, they *have been* snatched off
the wire and our of proxy caches and elsewhere.  While some issues with
cookies are due to programming bugs, some are wide open security holes.

A colleague and I produced this initial draft as an alternative to the
traditional cookie approach to try to secure session state:
http://tools.ietf.org/html/draft-salgueiro-secure-state-management

This was just our "straw man" proposal, but we think it is one worth
considering.  Ideally, the server would assign an encryption key via HTTPS.
This would be combined with a nonce produced at the client when the session
information is encrypted.  This would result in changing encrypted data and
the nonce value is monotonically increasing so the server can avoid replay
attacks.

It might not be a perfect solution to the problem, but it's a start at
something. 

In any case, we don't really care *how* we solve the problem, but we do
believe it needs to be solved.  Also important, we need a solution that can
be used with HTTP, not just HTTPS.

Paul

> -----Original Message-----
> From: http-state-bounces@ietf.org [mailto:http-state-bounces@ietf.org] On
> Behalf Of Shelby Moore
> Sent: Wednesday, August 25, 2010 1:04 PM
> To: http-state@ietf.org
> Subject: [http-state] Cookie login security inconsistency
> 
> Some of you know me already from the Hybi WG (WebSockets), so no need to
> introduce myself.
> 
> Please introduce to the record here, one specific inconsistency from prior
> cookies standard for best practices:
> 
> https://bugzilla.mozilla.org/show_bug.cgi?id=588704#c26
> 
> Also I would like to introduce the entire linked page above to the record
> of input to this WG. I notice that Mozilla appears to agree with me on the
> solution or way to proceed:
> 
> https://bugzilla.mozilla.org/show_bug.cgi?id=588704#c47
> 
> I am happy to see some people are working on the problem of http-state and
> I hope with an intent of closing the security holes.
> 
> Good luck with this.  I wish you all the best.
> 
> 
> ============
> Please note I am not joining this WG and will be unsubscribed after this
> post. Please remove my email address from any replies to this mailing
> list. If I have something else important to contribute, I will come back
> in the future.
> _______________________________________________
> http-state mailing list
> http-state@ietf.org
> https://www.ietf.org/mailman/listinfo/http-state