On those days I’m working, on my spare time, at a project for some friend of mine. It’s a PHP project that require an high level of security but also high usability. I’ve not worked a lot with PHP and others tag-injected languages so I’m not that wizard on this particular segment of the programming world. But I’m a freaking paranoic programmer and I am focused on security related to the persistent login feature.
A persistente login is the so-called “remeber me on this site” feature. You login once and everytime you access the site you are logged in again automatically. This is done with cookie. This can be done only with cookie. And you cannot store login and password in clear text. Unless you are stupid.
There are a lot of funny black hats out there and it’s vital to achieve the maximum possible security when you allow the users to auto-login. There are a lot of possible exploit that a malicious user can use in order to gain access to your user personal data:
- If he has access to your terminal he can open the web browser and use your account (even my cat can do that)
- If you have your hdd shared in an intranet he can steal your cookie and grab your personal data (a user that can open a folder with explorer/finder can do that)
- If you are browsing through an unprotected wifi he can sniff your packets (a user that can download a fucking man-in-the-middle nitfy utility can do that)
- blah blah blah
The lesson is: never store personal data. But this is impossible cause I must identify myself with the site I’m trying to access. Programmer says: store the personal data in the most paranoic obfuscated way.
Pages: 1 2
English
Italiano
2 responses ↓
1
Ark
on Sep 16, 2008 at 20:04 wrote
Use a GUID saved on the database and store that in the Cookie so you can join a GUID with a user
2
programmer
on Sep 19, 2008 at 19:48 wrote
I already do something like this. I use the three token with the refresh properties that add the maximum security. They are unique and are strictly binded with the user unique ID on my databases.
As a matter of facts I never expose the real ID but just a a bridge. I’ve added another feature. If a user log with a IP that is geographically distant from the previously used than the cookie is invalidated (not annoying a user that always connect from his home but that has a dynamic IP).
Leave a Comment