keeping password just in cookies, not in servers.

Thread Solved

Join Date: Oct 2009
Posts: 1
Reputation: byehye87 is an unknown quantity at this point 
Solved Threads: 0
byehye87 byehye87 is offline Offline
Newbie Poster

keeping password just in cookies, not in servers.

 
0
  #1
Oct 23rd, 2009
Hi,
Suppose a site doesn't store passwords on its server.
When the user creates a new account, his password is hashed together with his username and stored in a cookie insider his Web browser. When he comes to the site again and types in his username and password, the server hashes them pulls the cookie from the user’s browser and checks if the computed hash is equal to the hash
stored in the cookie. If they match, access is granted.
Can another person log into his account just be knowing the username i.e the victim's computer is offline and inaccessible( cannot be eavesdropped)
Reply With Quote Quick reply to this message  
Join Date: Feb 2009
Posts: 3,410
Reputation: sknake has much to be proud of sknake has much to be proud of sknake has much to be proud of sknake has much to be proud of sknake has much to be proud of sknake has much to be proud of sknake has much to be proud of sknake has much to be proud of sknake has much to be proud of sknake has much to be proud of 
Solved Threads: 615
Sponsor
sknake's Avatar
sknake sknake is offline Offline
.NET Enthusiast
 
0
  #2
Oct 23rd, 2009
Probably not except by brute force. This is a bad idea though since when the user loses their cookies they will no longer be able to log in. It is just a matter of time before they lose their browser settings.
Scott Knake
Custom Software Development
Apex Software, Inc.
Reply With Quote Quick reply to this message  
Reply

This thread has been marked solved.
Perhaps start a new thread instead?
Message:



Similar Threads
Other Threads in the Network Security Forum
Thread Tools Search this Thread



Tag cloud for Network Security
About Us | Contact Us | Advertise | DaniWeb | Acceptable Use Policy | RSS Feed

©2003 - 2009 DaniWeb® LLC