Re: password questions
- From: "Oliver Wong" <owong@xxxxxxxxxxxxxx>
- Date: Wed, 08 Feb 2006 17:54:53 GMT
"Roedy Green" <my_email_is_posted_on_my_website@xxxxxxxxxxxxxx> wrote in
message news:ab98u1lkfeu49o3diesp25dtd2951bpqqu@xxxxxxxxxx
How does the server remember that a client is logged in? Does the
browser send a cookie each time? Is some sort of login dance done on
ever transaction? is the userid/pasword embedded in the URL every
time?
What's usually done in the PHP world is that the first time a browser
goes to a site, it has no cookie, and says so when asked for one. So the
server then asks for username and password, which the browser provides. The
server then gives a cookie which contains a random number between 1 and a
gazillion. The server stores all relevant information (e.g. username and
password) in a file whose filename is the same as the number given to the
browser. Let's say, for example, the server gave the browser the number "42"
for the cookie.
The next request, the browser ask for a page, and gives the cookie with
the number "42". The server then looks a its files, finds the one labelled
"42", and now has the username and password and any other useful information
locally, all without the browser re-sending it.
Periodically, the server may delete all the files which are older than 5
minutes, for example.
A cracker makes a request, trying to masquerade as the authenticated
user. The server will ask for the number in the cookie. Since the cookie
number is any random number between 1 and a gazillion, and there are only,
say, 1 million active users at a time, the chances of the cracker guessing a
number that is currently in use is 1 million divided by 1 gazillion.
Generally, it's easier for the cracker just to say he doesn't have a
cookie, and try to guess the passwords, rather than guessing the cookie
number, because people tend to choose insecure passwords.
- Oliver
.
- References:
- password questions
- From: Roedy Green
- password questions
- Prev by Date: Re: Generating Random Numbers between a potentially negative range
- Next by Date: Re: what are the other ways to prevent a class from being subclassed. one way is to declare the class final.
- Previous by thread: Re: password questions
- Next by thread: Hot Swapping Resources
- Index(es):
Relevant Pages
|
|
