[MUD-Dev] Re: Quick question re: SSL

[ceo]

Christopher Allen wrote:

> Cookies based on the client's IP number are not going to work for
> you 100%, not

> What you want to do is, and has worked well for Skotos, is to pick
> some random number, and pass that on via a cookie along with the
> hash of it, the username, and something that only the server
> knows.  The user cannot with the username and the random number
> along figure out how to reproduce the hash (assuming you use a
> strong hash like MD5 and keep your server secret really secret).

Sorry, I should have been more specific here about the threat model.

IP number was to guard against "someone snoops network packets, uses
your cookie to login as you". Even now it works for approx 50%-70%
of players and possibly is worth doing for that 50-70%, although it
means all you have to do to circumvent it is change ISP :(.

In this attack, the attacker doesn't need to reproduce the hash -
they see it in the HTTP traffic the first time the user sends the
cookie back to your server. On the server, you cannot seem to
construct ANY relationship between "the client that originally
HTTPS'd to me, and the client that is HTTP'ing to me" - the IP
address for each is different, and you can't just say "associate the
first IP that presents that token as being the correct client",
because then you're assuming there is only ONE set of proxys/caches
that the traffic travels through (which doesn't appear to be true
for all ISP's).

IIRC this is of the "Replay" type of attack - as an attacker, you
observe the "magic number/token" that is a valid response to a
server challenge, and then replay the same magic number the first
time the server challenges you. Of course this is why most security
protocols include the sender and receiver "addresses" inside
whatever's encrypted, but my problem here is that I don't seem to
have a notion of a client "address" which I can actually know/check
for all clients :(.

PS caches seem to fairly consistently use the extended
(i.e. non-standard) HTTP headers to indicate the IP address they are
routing on behalf of; I haven't checked *every* ISP of every player,
but I may be able to use these extended headers to infer the same IP
address for a client, no matter which proxy/cache they come via.

Adam M
_______________________________________________
MUD-Dev mailing list
MUD-Dev at kanga.nu
https://www.kanga.nu/lists/listinfo/mud-dev