David, Marvin Simkin said it well; I didn't.

On Tue, May 20, 2008 at 4:43 AM, David Howe
<DaveHowe.Pentest (at) googlemail (dot) com [email concealed]> wrote:
> Matthew Zimmerman wrote:
>>
>> In my opinion, if you want to mitigate this, don't use passwords. Use
>> true challenge-response. Everything else proposed here is either
>> obfuscation or doesn't really work in a web application environment.
>> A VPN around a webserver only works if every user that needs access to
>> that webserver can also access the vpn.
>
> that is unfortunately only security though obscurity, and barely worth doing
> - it raises the bar quite a bit (in that the MiTM attacker must also modify
> the transmitted page to request a plaintext password instead. a much more
> demanding task than just recording traffic) but requires that you send
> javascript, java or flash code to actually do the challenge-response
> protocol (and manage the inevitable clients who will have that turned off
> then complain that your site "requires" things they consider a security
> issue).
Maybe I didn't state it correctly, challenge/response was the wrong
term to use. PKI, SecurID, etc. Something that involves something
you are or something you have in addition to something you know (e.g.,
a password). You are correct that obfuscating the password by some
client side script/addon will not work. That was not my intention.
>
> Ultimately though, if your attacker can successfully read and modify the
> browser channel (either using browser plugins or indirectly by intercepting
> and modifying the page stream via a MiTM attack) or intercept the data entry
> channel (keyboard/mouse) you have already lost.
Right. You break the SSL tunnel, you also have the user's cookie,
which means you don't care about a "password" anymore. The cookie is
your password.
>

------------------------------------------------------------------------

This list is sponsored by: Cenzic

Top 5 Common Mistakes
in Securing Web Applications
Find out now! Get Webinar Recording and PPT Slides

www.cenzic.com/landing/securityfocus/hackinar
------------------------------------------------------------------------

[ reply ]