RE: [WEB400] FW: CIPHER'n problem

["Haas, Matt" <Matt.Haas@xxxxxxxxxxx>]

Walden,

I'm going to have to admit to a case of not seeing the forest for the trees on 
this one (still, messing with CIPHER was fun and I will need to use what I 
developed down the road) or at least trying too hard to make what I'm doing 
work more like the save password feature in IE and Mozilla based browsers. 
We're currently using a session cookie that's basically what you describe as 
option three. The session cookie is a hash of a GUID and a few other things and 
we store the hash and an expiration date in a table. Since it's a session 
cookie that expires after a period of inactivity, we're not putting anything to 
lock it to a single machine but that's a great idea.

Thanks,

Matt

-----Original Message-----
From: Walden H. Leverich [mailto:WaldenL@xxxxxxxxxxxxxxx]
Sent: Wednesday, October 06, 2004 9:29 AM
To: Web Enabling the AS400 / iSeries
Subject: [WEB400] FW: CIPHER'n problem


All,

This is moved from the RPG list since it's become a Web topic, not an
RPG topic.

Matt,

I still wouldn't store the password in the cookie, encrypted or not. If
someone breaks the encryption, or just hijacks the cookie, they'll be
able to get on w/o a problem and no one will know. Since you've moved to
forms-based authentication you have many more options since you are in
complete control of the process. We've done a couple of ways in the
past. 

First, store the username and a flag that says they're authenticated.
The advantage here is that while they can still hijack the cookie, at
least then can't get the password to allow them access from anywhere
since the password isn't in the cookie. The disadvantage is that a
change of the password on the server side doesn't invalidate the stored
login.

Second, store the username and a hash of the password, but not the
password itself. This way if the password is changed on the server side
the hash is now different and invalid.

Third, and my current favourite, store a GUID in the cookie. The GUID is
your key to a server-side table that contains a list of "remember me"
entries. If they have a valid "remember me" then they bypass the login
process. The advantage here is that you can kill all "remember me"
entries for a user by deleting the rows in the table. So if the user
doesn't have access to a PC any longer he can still force that PC to
forget. You can also add logic like allowing a user to remember me from
only one PC at a time. When they click remember me from the second PC
you delete the row for the old PC. The only thing you need to take care
of is how you deal with changed passwords. You can just delete all
remember me entries when the password changes, or store some hash of the
password in the remember me row.

JMTCW.

-Walden

------------
Walden H Leverich III
President & CEO
Tech Software
(516) 627-3800 x11
WaldenL@xxxxxxxxxxxxxxx
http://www.TechSoftInc.com 

Quiquid latine dictum sit altum viditur.
(Whatever is said in Latin seems profound.)
 
-----Original Message-----
From: rpg400-l-bounces@xxxxxxxxxxxx
[mailto:rpg400-l-bounces@xxxxxxxxxxxx] On Behalf Of Haas, Matt
Sent: Tuesday, 05 October, 2004 13:55
To: RPG programming on the AS400 / iSeries
Subject: RE: CIPHER'n problem

I know better than to save credit card or SSN information in a cookie
(encrypted or not). Basically, what we did is switch from basic
authentication to using forms and I've been asked for the site to
remember the login information so the customers don't need to type in
their user id and password (basically, the same functionality the
"remember me" check box in the basic auth dialog gives you). If my
thinking's correct, this will be better security than what we had with
basic auth since login information will be passed both to and from the
server encrypted instead of Base64 encoded. If you have better ideas
about accomplishing this, I'd love to hear them but we should either go
off-list or switch to either Web-400 or Ignite/400 since it really isn't
an RPG topic.

If nothing else, I know there are other things coming up that will
require encryption and now I have a working program to use as a base for
something production level.

Matt

-----Original Message-----
From: Walden H. Leverich [mailto:WaldenL@xxxxxxxxxxxxxxx]
Sent: Tuesday, October 05, 2004 12:28 PM
To: RPG programming on the AS400 / iSeries
Subject: RE: CIPHER'n problem


>For an upcoming project, I need to store some encrypted data in 
>a cookie which has me looking at using the CIPHER MI 
>instruction to do this. 

OK, I know this isn't what you asked, but I can't resist... WHY? You
shouldn't be saving anything in a cookie that needs to be encrypted. If
you're saving any personal information (name, credit card #, SSN, etc.)
in the cookie, please don't. If you're saving the key to your
server-side files that contain that information then why bother
encrypting it? 

-Walden


------------
Walden H Leverich III
President & CEO
Tech Software
(516) 627-3800 x11
WaldenL@xxxxxxxxxxxxxxx
http://www.TechSoftInc.com 

Quiquid latine dictum sit altum viditur.
(Whatever is said in Latin seems profound.)