[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
- From: "Chris Varenhorst" <varenc@xxxxxxx>
- Subject: Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?
- Date: Tue, 17 Jun 2008 21:51:05 -0400
------=_Part_30708_14177782.1213753865575
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Just to jump in....netvibes.com seems to have a javascript implementation of
md5. The js code referenced is here..
http://cdn.netvibes.com/js/c/Netvibes.js?v=410
its a bit unreadable as is, but you can find other implementations around
the internet.
I'm not sure if hashing the password on the client side would be best
practice (anyone have a strong opinion?) but it seems effective.
-Chris
On Tue, Jun 17, 2008 at 4:37 PM, wilke rodriquez <wilkepower@msn.com> wrote:
>
> What is considered best practice in this area? How is it that sites like
> netvibes.com are able to hash the password before transmission, I couldn't
> find any javascript code doing the hashing there.
>
>
> ------------------------------
> > Date: Mon, 16 Jun 2008 16:04:34 -0400
> > From: rklists@gmail.com
> > To: wilkepower@msn.com
> > Subject: Re: [WEB SECURITY] username & pw in clear-text through SSL
> considered safe?
> > CC: websecurity@webappsec.org
>
> >
> > It seems like the issue may have become confused a bit.
> >
> > The original question was in regards to transmitting credentials in
> > an HTTP Header. This does not necessarily mean a URL. An example of a
> > sensitive, non-URL header value that is used regularly is a Session ID
> > in a cookie. Since this is the de-facto way of handling session
> > management in most web applications, we'd really be in trouble if we
> > couldn't trust the confidentiality of sensitive data transmitted
> > through HTTP Headers (except, of course, for URLs).
> >
> > Cheers,
> >
> > Rohit Sethi
> > Manager, Professional Services
> > Security Compass
> > http://www.securitycompass.com
> >
> > On Sun, Jun 15, 2008 at 9:28 PM, wilke rodriquez <wilkepower@msn.com>
> wrote:
> > > Hi All,
> > >
> > > I recently came across a website that passed the user credentials
> through
> > > the http header in clear-text but via https.
> > > Is this practice considered secure?
> > > Would this also show that the passwords are being stored in clear-text
> and
> > > not encrypted with a salt value in the db?
> > > It seems to be there are a few more secure options when dealing with
> > > authentication what do you all suggest as the best for a low user (less
> than
> > > 10) system?
> > > The system does need added security due to the contents.
> > >
> > > Thanks
> > >
>
------=_Part_30708_14177782.1213753865575
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Just to jump in....<a href="http://netvibes.com";>netvibes.com</a> seems to have a javascript implementation of md5. The js code referenced is here.. <a href="http://cdn.netvibes.com/js/c/Netvibes.js?v=410";>http://cdn.netvibes.com/js/c/Netvibes.js?v=410</a> <br>
its a bit unreadable as is, but you can find other implementations around the internet.<br><br>I'm not sure if hashing the password on the client side would be best practice (anyone have a strong opinion?) but it seems effective.<br>
<br>-Chris<br><br><div class="gmail_quote">On Tue, Jun 17, 2008 at 4:37 PM, wilke rodriquez <<a href="mailto:wilkepower@msn.com";>wilkepower@msn.com</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div><br>What is considered best practice in this area? How is it that sites like <a href="http://netvibes.com"; target="_blank">netvibes.com</a> are able to hash the password before transmission, I couldn't find any javascript code doing the hashing there.<br>
<br><br>
<hr>
> Date: Mon, 16 Jun 2008 16:04:34 -0400<br>> From: <a href="mailto:rklists@gmail.com"; target="_blank">rklists@gmail.com</a><br>> To: <a href="mailto:wilkepower@msn.com"; target="_blank">wilkepower@msn.com</a><div class="Ih2E3d">
<br>> Subject: Re: [WEB SECURITY] username & pw in clear-text through SSL considered safe?<br></div>> CC: <a href="mailto:websecurity@webappsec.org"; target="_blank">websecurity@webappsec.org</a><div><div></div><div class="Wj3C7c">
<br>> <br>> It seems like the issue may have become confused a bit.<br>> <br>> The original question was in regards to transmitting credentials in<br>> an HTTP Header. This does not necessarily mean a URL. An example of a<br>
> sensitive, non-URL header value that is used regularly is a Session ID<br>> in a cookie. Since this is the de-facto way of handling session<br>> management in most web applications, we'd really be in trouble if we<br>
> couldn't trust the confidentiality of sensitive data transmitted<br>> through HTTP Headers (except, of course, for URLs).<br>> <br>> Cheers,<br>> <br>> Rohit Sethi<br>> Manager, Professional Services<br>
> Security Compass<br>> <a href="http://www.securitycompass.com"; target="_blank">http://www.securitycompass.com</a><br>> <br>> On Sun, Jun 15, 2008 at 9:28 PM, wilke rodriquez <<a href="mailto:wilkepower@msn.com"; target="_blank">wilkepower@msn.com</a>> wrote:<br>
> > Hi All,<br>> ><br>> > I recently came across a website that passed the user credentials through<br>> > the http header in clear-text but via https.<br>> > Is this practice considered secure?<br>
> > Would this also show that the passwords are being stored in clear-text and<br>> > not encrypted with a salt value in the db?<br>> > It seems to be there are a few more secure options when dealing with<br>
> > authentication what do you all suggest as the best for a low user (less than<br>> > 10) system?<br>> > The system does need added security due to the contents.<br>> ><br>> > Thanks<br>> ><br>
</div></div></div>
</blockquote></div><br>
------=_Part_30708_14177782.1213753865575--
Brought to you by http://www.webappsec.org
Search this site
|