Hi,
Thanks Rogan and everyone else for replying to my query and the
responses were quite helpful. Ok, here I'll give one scenario to make
it even more clear if someone could not understand my point correctly.
Suppose this is an e-commerce application and a user is trying to
access it through some shared computer such a Internet cafe or a
hotel. Now my worry is that it is possible to capture user
credentials by deploying a web proxy client, no matter the
application is using GET or POST methods or is using an encrypted
session. Yes, user would get an SSL error message but only in Firefox
as I have not seen such message appearing in IE yet (I'm using IE6).
From the responses till now, it appears to me that using salted
hashes of passwords is the best way as it would not appear as plain
text in web proxy. Also server generates a new hash using a new salt
every time a user wants to authenticate to avoid replay attacks.
Any other thoughts or suggestions would be much appreciated.
Regards
Vishal
At 10:56 6/7/2007, Rogan Dawes wrote:
Vishal Garg wrote:
Hi All,
Can someone please tell what is the most secure way of sending
login credentials to the server. The possible ways that I am familiar with are:
- get method
- post method
These are HTTP methods for sending parameters.
- hidden form fields
This is a technique for defining parameters which will result in one
or other of the GET or POST methods (above) being executed.
By using an encrypted connection we cannot sniff the credentials,
but still it is very easy to capture or manipulate these
credentials using a web proxy from any of these methods. So I am
looking to find a method to transport the credentials to the server
so that the security of these credentials can't be compromised even
by deploying a web proxy.
The proxy can only be used by someone who accepts the certificate
validation error that appears in the browser. If you are worried
that your users might be trying to subvert your login process, the
odds are good that you are trying to make your login process too complex!
In the normal event, your users will know their username and
password, so trying to prevent them from intercepting these same
values is completely pointless. If your concern is regarding
cleartext passwords being available on the server (e.g. you don't
ever want clear text passwords to leave the browser), you may want
to consider something like Secure Remote Password (SRP). However,
this requires a Java applet or ActiveX control for performing the
crypto and generating random numbers, and is unlikely to be popular.
Also once a session id is generated, what is the best way to
maintain the security of a session id.
See http://www.owasp.org/index.php/Session_Management
Any help would be much appreciated.
Regards
Vishal
Hope this helps.
Rogan
-------------------------------------------------------------------------
Sponsored by: Watchfire
The Twelve Most Common Application-level Hack Attacks
Hackers continue to add billions to the cost of doing business online
despite security executives' efforts to prevent malicious attacks. This
whitepaper identifies the most common methods of attacks that we have seen,
and outlines a guideline for developing secure web applications.
Download today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe
--------------------------------------------------------------------------
