Question about Shib session cookie protection

[Wessel, Keith]

Thank you, Scott. That's precisely what I thought.

Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, November 05, 2013 4:14 PM
To: Shib Users
Subject: Re: Question about Shib session cookie protection

On 11/5/13, 5:09 PM, "Wessel, Keith" <kwessel at illinois.edu> wrote:

>All,
> 
>I had a question posed to me this afternoon about how Shib SP session
>cookies are protected during transport when the SP isn¹t using https. If
>a hacker listens in on http traffic and grabs a user¹s session cookie and
>can then use the same
> IP as that user (such as a coffee shop with a nat¹d setup), what¹s
>keeping the hacker from using the user¹s session?

Nothing. Nothing can. If somebody tells you a different system doesn't
have this property, they're misled.

> 
>I see nothing on the wiki about this. Can anyone shed any light on what
>keeps this cookie from being stolen?

That's how cookies work. It's why using http:// is a waste of time and
you're better off posting a page in front that asks people not to be bad
and misuse data. That's just as effective and a lot cheaper than
authenticating people.

I'm not kidding either, we have actual applications that do this and they
experience little if any trouble, because the content is not of interest
to attackers. I encourage it.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net