If you own the customer base, you could almost use the persistent cookie
like an SSL cert (in a sense at least) since you could just preload it
onto user machines ;)
-----Original Message-----
From: Jeff Robertson [mailto:jeff.robertson@digitalinsight.com]
Sent: Tuesday, July 18, 2006 1:01 PM
To: Ryan Barnett; Rogan Dawes
Cc: webappsec@securityfocus.com
Subject: RE: Cookies as the second factor
-----Original Message-----
From: Ryan Barnett [mailto:rcbarnett@gmail.com]
I think we are mixing persistent/session cookie concepts
here. I believe that the scenario that Jeff was trying to
describe (and please correct me Jeff if I am wrong here) is
if you use both a password and a persistent cookie to
initially log into an appliaction and then the app can issue
whatever sesisonid cookies it needs to track the session
state and provide authorization.
Yes, this is the kind of thing I was thinking about.
------------------------------------------------------------------------
-
Sponsored by: Watchfire
AppScan 6.5 is now available! New features for Web Services Testing,
Advanced Automated Capabilities for Penetration Testers, PCI Compliance
Reporting, Token Analysis, Authentication testing, Automated JavaScript
execution and much more.
Download a Free Trial of AppScan today!
https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
------------------------------------------------------------------------
-
-------------------------------------------------------------------------
Sponsored by: Watchfire
AppScan 6.5 is now available! New features for Web Services Testing,
Advanced Automated Capabilities for Penetration Testers, PCI Compliance
Reporting, Token Analysis, Authentication testing, Automated JavaScript
execution and much more.
Download a Free Trial of AppScan today!
https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
-------------------------------------------------------------------------
