Log in with username/password: lyceum/lyceum

Ticket #149 (assigned enhancement)

Opened 3 years ago

Last modified 9 months ago

one-time password system -- password timeout

Reported by: jjb Assigned to: jjb (accepted)
Priority: normal Milestone: Diverges from WordPress
Keywords: Cc: adamc@unc.edu

Description (Last modified by jjb)

dependent on ticket:235

session token is reset from time to time, if a valid session cookie is present. persistent logins, without having username and password in cookie, and without loosing any security or conveniencce.

see shiflett pp69-73

enhancement to shiflett model: is there any reason to not generate a new token for every request?


adamc:

Off the top of my head, the approach I would favor here is shifting from the passing of Kerberos passwords (even hashed ones, as Mike pointed out; md5 and even sha-1 are falling victim to Moore's law and some sophisticated mathematics) around in cookies, to using one-time session keys. Upon successfully authenticating via Kerberos [ mechanism to be determined =) ], a session key for the user would be created that allows access to whatever the user has privileges to access. Effectively, the session key is a one-off password.

That key would be what's remembered. That way, if the cookie is ever sniffed, the only thing that's lost is something that temporarily allows access to this one resource, rather than the compromise of the user's Onyen account.

Change History

11/03/05 11:01:17 changed by jjb

  • status changed from new to assigned.
  • description changed.

01/19/06 15:28:24 changed by jjb

  • description changed.
  • milestone changed from The Future to 0.11 - security.

01/26/06 13:57:55 changed by jjb

  • description changed.
  • milestone changed from 0.11 - security to The Future.

01/26/06 14:01:57 changed by jjb

  • component changed from General to security.

04/18/06 00:40:49 changed by jjb

  • description changed.
  • cc set to adamc@unc.edu.
  • summary changed from one-time password system to one-time password system -- password timeout.
  • priority changed from normal to high.
  • milestone changed from The Future to 0.40.
  • keywords deleted.
  • type changed from defect to enhancement.

05/31/06 23:37:22 changed by jjb

chris says:

"On the topic of the login cookie timeout... I was going to make it so that an existing session would not need reauthentication from a user, it would be automatically refreshed."

Sounds like you're describing a persistent login cookie (e.g., remember me). I'd follow Google's lead and make these expire in two weeks or less. There is an example implementation here:

http://phpsecurity.org/code/ch07-3

http://phpsecurity.org/code/ch07-4

10/20/07 23:19:05 changed by jjb

  • milestone changed from 1.0.1 to 1.1.1.

10/20/07 23:51:37 changed by jjb

  • priority changed from high to normal.
  • milestone changed from 1.1.1 to Diverges from WordPress.
Log in with username/password: lyceum/lyceum