[Kolab-devel] kolab-webadmin/www/admin/user user.php, 1.3, 1.4

[Bernhard Reiter]

On Tuesday 25 May 2004 12:36, Martin Konold wrote:
> Am Tuesday 25 May 2004 11:37 am schrieb Bernhard Reiter:

> > If there are security implications we should base
> > it on arguments.
>
> Excactly!
>
> > As far as I understood it, Steffen is right in that
> > an IP should not change during a session and protecting
> > against this is a small added security measure.
>
> Your assumption is wrong. There are _legitimate_(*) changes of the source
> address during a http session(**).

> (*) Roaming Setups, DHCP clients, load balancing web proxies, redundant ISP
> links.....
> (**) Please note that http is in contrast to popular believe not based on
> persistent connections!

Now that you have made that argument I can better see your point.

> As mentioned before there is not a single case where this extra code really
> helps to defend against a real attack but it breaks legitimate use cases.

As far as I understood:
It is an attack to get session cookies from a browser
partly Steffen's code would offer some protection.

> My conclusion: Wrong solution to the wrong problem.

It looks like almost all security decisions:
Both ways have their good and their bad sides
and there is no perfect solution.
Breaking real use cases certainly has some weight.
Steffen, what do you think in light of the new arguments?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2145 bytes
Desc: signature
URL: <http://lists.kolab.org/pipermail/devel/attachments/20040528/25186b6e/attachment.p7s>