There's no reason a cookie couldn't be generated client-side. I could
easily have a client-side application generate a 'secure', one-time
use token, populate a cookie and then use that value as one part of a
multi-factor authentication scheme.
On 7/18/06, Rogan Dawes <discard@dawes.za.net> wrote:
Jeff Robertson wrote:
> It seems like it's been mentioned on here before, that a number of "two
> factor" or "multi factor" authentication schemes actually use a cookie
> as the second factor.
>
> Anyone here have specific experience with such solutions, or opinions
> about how much security they add to a system?
>
Sounds completely bogus to me.
The cookie is typically generated by the server, as a response to an
authentication event (single or multi-factor). The cookie is then used
to maintain that authentication from request to request.
There is NO authentication component in such a cookie. It is created by
the SERVER, and as such CANNOT qualify as an authentication factor at all.
Rogan
-------------------------------------------------------------------------
Sponsored by: Watchfire
AppScan 6.5 is now available! New features for Web Services Testing,
Advanced Automated Capabilities for Penetration Testers, PCI Compliance
Reporting, Token Analysis, Authentication testing, Automated JavaScript
execution and much more.
Download a Free Trial of AppScan today!
https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
-------------------------------------------------------------------------
--
Thank you,
Darren Bounds
-------------------------------------------------------------------------
Sponsored by: Watchfire
AppScan 6.5 is now available! New features for Web Services Testing,
Advanced Automated Capabilities for Penetration Testers, PCI Compliance
Reporting, Token Analysis, Authentication testing, Automated JavaScript
execution and much more.
Download a Free Trial of AppScan today!
https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
-------------------------------------------------------------------------
