3 ms·
These systems work using pub/private keys, signing each outgoing request (much like traditional tls). If you were able to get the cookies, you’d be unable to us
by kevlened 3y ago
These systems work using pub/private keys, signing each outgoing request (much like traditional tls). If you were able to get the cookies, you’d be unable to use them from another browser unless you also extracted the private key.
- ec109685 3y agoYeah, I get the idea and it seems promising. But how would a company deploy a solution today using this technique?
- kevlened 3y agoWhile the TLS-based version was removed from Chrome [0], you can implement a less efficient (and slightly less secure) version in js. I created an example [1]. The gist is: 1. Client creates a key pair in js 2. Client sends pub key on initial auth 3. Server validates auth and attaches pub key to cookie 4. Client signs each request payload with a timestamp 5. Server validates signature and timestamp The security issue is in step 1. WebCrypto can generate non-extractable private keys and store them in indexeddb. However, this assumes no malicious code flips the “extractable” flag before the pair is generated. So this strategy is trust-on-first-use. [0] - https://chromestatus.com/feature/5097603234529280 https://chromestatus.com/feature/5097603234529280 [1] - https://github.com/kevlened/prevent-exfiltration/blob/main/index.mjs https://github.com/kevlened/prevent-exfiltration/blob/main/i...