additional security measures besides a login with user-password - what can you think of?

Posted by Tom Tom on Stack Overflow See other posts from Stack Overflow or by Tom Tom
Published on 2010-03-30T18:19:43Z Indexed on 2010/03/30 18:23 UTC
Read the original article Hit count: 483

Filed under:

server

|

web-security

I'm wondering which additional security measures one could take besides a traditional login with user and password.

What do you think of this one:

_manually adding a cookie to each client which includes a secret key

_this cookie is not served by the webserver, it is actually copied "by hand" to each client computer

_if a client connects to the web-app the server graps that cookie and if the containing secret key is ok, the traditional login box is presented where the user has to enter the user-password combination

_communication between client and server is encrypted with https

Thus a potential intruder would first need to get the cookie from the clients computer, which is only possible with having access to the clients computer.

This would work only for a very small user-base and an admin willing to do this manual work.

© Stack Overflow or respective owner

Related posts about server

SQL SERVER – Server Side Paging in SQL Server 2011 Performance Comparison

as seen on SQL Authority - Search for 'SQL Authority'
Earlier, I have written about SQL SERVER – Server Side Paging in SQL Server 2011 – A Better Alternative. I got many emails asking for performance analysis of paging. Here is the quick analysis of it. The real challenge of paging is all the unnecessary IO reads from the database. Network traffic was… >>> More
Should I switch my server to Ubuntu Server from Windows Server 2003

as seen on Server Fault - Search for 'Server Fault'
I have a server thats primarily used for SRCDS, I host a few Team Fortress 2 servers on it and I would much prefer a ssh-like (more so the no-gui part) for something like this, mostly because I can't navigate with my phone on VNC very well and also because there really is no need for a gui in this… >>> More
Windows web server and SQL Server on same dedicated server

as seen on Server Fault - Search for 'Server Fault'
I'm currently trying to decide on the best approach to handle hosting a few moderate traffic websites for production e-commerce and online applications. We'd like to move to a dedicated server and are looking at this as the most likely machine: Quad Core Intel Core2Quad Q9550 Processor, 2.83 Ghz… >>> More
Windows 7 Desktop/Start Menu Redirection: Server O/S: Windows Server 2003 And Server 2008

as seen on Super User - Search for 'Super User'
Hi, I am new here so I am might be asking a question which has already been answered [however I can't see it in the suggested answers above] I manage a network which is split into a parent domain and a child domain. Recently I have been looking at when to migrate to Windows 7. The child domain… >>> More
Windows 7 Desktop/Start Menu Redirection: Server O/S: Windows Server 2003 And Server 2008

as seen on Server Fault - Search for 'Server Fault'
Hi, I am new here so I am might be asking a question which has already been answered [however I can't see it in the suggested answers above] I manage a network which is split into a parent domain and a child domain. Recently I have been looking at when to migrate to Windows 7. The child domain… >>> More

Related posts about web-security

System.Web.Security.FormsAuthentication.Encrypt returns null

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm trying to encrypt some userData to create my own custom IPrincipal and IIdentity objects using Forms authentication - I've serialized an object representing my logged in user to Json and created my FormsAuthentication ticket like so: string user_item = GetJsonOfLoggedinUser();/*get JSON representation… >>> More
Google Releases Web Security Scanner

as seen on Devx - Search for 'Devx'
"Skipfish" helps developers test their Web apps for vulnerabilities. >>> More
Google Releases Web Security Scanner

as seen on Internet.com - Search for 'Internet.com'
"Skipfish" helps developers test their Web apps for vulnerabilities. >>> More
Web Security Threats on the Rise, Report Finds

as seen on Dot net Slackers - Search for 'Dot net Slackers'
It may not be Tony Soprano on the Web, but a new security report finds that wise-guy hackers have become increasingly organized....Did you know that DotNetSlackers also publishes .net articles written by top known .net Authors? We already have over 80 articles in several categories including Silverlight… >>> More
Web Security: Worst-Case Situation

as seen on Stack Overflow - Search for 'Stack Overflow'
I currently have built a system that checks user IP, browser, and a random-string cookie to determine if he is an admin. In the worst case, someone steals my cookie, uses the same browser I do, and masks his IP to appear as mine. Is there another layer of security I should add onto my script to make… >>> More