Tickets :: Comment on [#8423] Security Audit

* Your Email Address
* Spam protection	Enter the letters below: __. .. .. .. . (__ \|\|\ \|\|__\|\|\ \| .__)\__\|\| \\|\| \|\| \\|
Comment	> deprecate blatantly insecure auth schemes; make sure to use a salted > auth scheme by default > > > > need a hook or setting to limit # of unsuccessful login attempts to horde > > > > need a hook or setting to limit easily guessable passwords > > > > require re-authentication before changing passwords, or other > sensitive operations > > > > don't use the same secret key for multiple purposes > > allow key rotation > > > > reference: > > http://cookies.lcs.mit.edu/ > > http://pdos.csail.mit.edu/papers/webauth:sec10.pdf > > > > make sure cookies are set with the secure flag when ssl is used > > > > get rid of URL-based sessions entirely > > > > limit the lifetime of even session-based cookies > > > > authenticator cookie: > > exp=t&data=s&digest=MAC(xp=t&data=s) > > - push the username and some other basic info (browser string, ip, > ... ?) into the data parameter ("s"), to avoid having to init the > session on most page loads > > > > - store other session data by key in a backend, accessed on-demand > and saved only when dirty? what about commonly used info like prefs? > cache with username in the key in the cache backend instead?
Attachment
Watch this ticket