There are a number of different authentication methods available to choose from when launching (or updating) a Web application. Choosing the wrong method can leave the system (or worse, the users) vulnerable to cyber attacks or
identity theft.
Below are five rules that should always be obeyed (regardless of the method). By considering these rules and how your users will use your system, you can better understand the security requirements of your Web application and can choose the right method.
1) Never send clear user passwords over an unencrypted channel.
When passwords are sent over an unencrypted channel, anyone who has access to the network (and a little know how) can read them. This should never be done with user supplied passwords (not even for intranet websites). Users often use the same password for multiple systems. Exposing a user's password in one system puts them at risk in another.
Both basic authentication and form-based authentication are vulnerable to this and should never be used when users can choose their own passwords. Digest authentication and encrypted logins do not send clear passwords, and can be used when users can choose their own passwords.
HTTP basic authentication and
HTML form-based logins can be used in secure networks to restrict Web access as long as the passwords are pseudo random, unpredictable, and unique across other systems.
For systems that allow user created passwords, care must be taken to ensure the passwords are not readable by others by using
HTTPS or
digest during logins.
2) Never send session tokens unencrypted over a shared network.
Unencrypted
session tokens are visible to anyone who has access to the network. Although session tokens don't expose the user's password, they do allow
hijacking accounts with unlimited access. This should never be used over a public wifi network (or other shared network) to access private information or make changes.
Cookie based authentication over HTTP is vulnerable to this.
Digest authentication and
HTTPS sessions are not vulnerable.
Digest authentication uses a unique
"salt" for every request and digest systems prevent the same "salt" being used more than once (although this is optional). By never using and never allowing the same authentication token twice, digest authentication prevents account hijacking.
HTTPS requests are encrypted and prevent
eavesdropping from others on the network, preventing access to any request tokens that might be present.
Only allow HTTPS using keys from a
certificate authority, HTTPS with
self signed keys, HTTPS with mixed content or digest authentication should be used to exchange private information over shared networks.
For more information about the vulnerabilities of using session tokens see
Weaning the Web Off of Session Cookies.
3) Always verify information sent over an insecure network.
Insecure networks may be vulnerable to malicious attacks such as
DNS posioning, or a
trojan Web proxy. These attacks are often called
man-in-the-middle and can manipulate the content from the server before it reaches the client (and vice-versa).
Most unencrypted HTTP communication is vulnerable to this. Even mixed content of both HTTPS and HTTP is vulnerable to man-in-the-middle because compromised HTTP content can read and manipulate HTTPS content.
Although digest authentication includes an optional integrity check to prevent this, most browsers either don't check or don't indicate to the user if the content has been verified.
All Web browsers verify HTTPS content (when not mixed) and this should be used for insecure networks. For mobile devises that often connect from potentially insecure networks HTTPS (self signed or CA signed) should be enabled by default for any private information.
4) Never give confidential information without verifying authenticity of the server.
Well
disguised URLs and familiar looking pages can trick users into visiting and pseudo-logging into illegitimate websites. If your website asks your users for confidential information, ensure there is a clear way for your users to verify the authenticity of the site before logging in. Otherwise, your users might give confidential information to untrustworthy third parties without even knowing it.
HTTPS using previously distributed keys (such as keys from an established
certificate authority) allow the user to verify the organization in their browser (near the address bar). This allows the user to quickly verify authenticity of the server.
HTTPS with self sign certificates cannot be used to verify authenticity unless they have been previously distributed through a secure channel.
Although digest authentication can include
authentication-info to verify authenticity, most browsers either ignore it or don't indicate to the user when the site is verified. However, most browsers do show the host name and realm to the user for review before logging in and this does give the user a chance to check to domain name before logging in.
Always use HTTPS for confidential, or sensitive information.
5) Never access sensitive information over an unencrypted channel.
HTTP traffic can be viewed by any who has access to the network. It is vital that all sensitive information is never sent over unencrypted HTTP. Sensitive information should always use HTTPS.
Only exclusively HTTPS with known certificates should be used to exchange sensitive information with its users.
Always use HTTPS for confidential, or sensitive information.
In summary
By obeying these five rules you can pick the right authentication method and prevent your system and users from being vulnerable to cyber attacks and identify theft.
Posts
