Well, if the cookie was persistent, then maybe you could count that as
"Something you have" for authentication. The trick is, how did you
verify the user during the initial issuance of the persistent cookie?
Catch-22 here. This would have to treated in the same manner as
issuing PKI certs where you need verifiable proof that the user who is
receiving the software/device/cookie is the correct person. When
issuing certs for smart cards, etc... you normally need a face-to-face
meeting. There may also be an issue with the security levels
protecting the cookie on the computer. How difficult would it be for
someone to gain access to the cookie stored on the computer?
--
Ryan C. Barnett
Web Application Security Consortium (WASC) Member
CIS Apache Benchmark Project Lead
SANS Instructor, GCIA, GCFA, GCIH, GSNA, GCUX, GSEC
Author: Preventing Web Attacks with Apache
On 7/18/06, Jeff Robertson <jeff.robertson@digitalinsight.com> wrote:
It seems like it's been mentioned on here before, that a number of "two
factor" or "multi factor" authentication schemes actually use a cookie
as the second factor.
Anyone here have specific experience with such solutions, or opinions
about how much security they add to a system?
-------------------------------------------------------------------------
Sponsored by: Watchfire
AppScan 6.5 is now available! New features for Web Services Testing,
Advanced Automated Capabilities for Penetration Testers, PCI Compliance
Reporting, Token Analysis, Authentication testing, Automated JavaScript
execution and much more.
Download a Free Trial of AppScan today!
https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
-------------------------------------------------------------------------
-------------------------------------------------------------------------
Sponsored by: Watchfire
AppScan 6.5 is now available! New features for Web Services Testing,
Advanced Automated Capabilities for Penetration Testers, PCI Compliance
Reporting, Token Analysis, Authentication testing, Automated JavaScript
execution and much more.
Download a Free Trial of AppScan today!
https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
-------------------------------------------------------------------------
