<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-2022-jp">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<meta content="text/html; charset=UTF-8">
<style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<p>One thing here is that a cookie has to be constant across an environment.</p>
<p><br>
</p>
<p>It's not easy to rotate it by tackling a few nodes at a time, and you can't define a new username, roll it out, and disable the old one later. As far as I know, it's always transferred in cleartext, and doesn't authenticate who it is being given to.</p>
<p><br>
</p>
<p>By modern security standards, it's very poor. But I also agree, the mere use cookies, from an outside attacker, is still a mile ahead of authenticated access, unless I'm missing something.<br>
</p>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> erlang-questions-bounces@erlang.org <erlang-questions-bounces@erlang.org> on behalf of zxq9 <zxq9@zxq9.com><br>
<b>Sent:</b> Friday, 10 June 2016 2:33:25 PM<br>
<b>To:</b> erlang-questions@erlang.org<br>
<b>Subject:</b> Re: [erlang-questions] Erlang cookies are secure</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">On 2016年6月9日 木曜日 22:44:57 Louis Pilfold wrote:<br>
> Hi!<br>
> <br>
> In the event that the cookie is your only security, what do you do<br>
> when your cookie gets out?<br>
> <br>
> Event if you cookie is not guessable, there is still a chance that<br>
> through malicious act or human error a trusted person within your<br>
> organisation shares your cookie with others. I've not got the evidence<br>
> to hand, but while preparing for security audits at a previous<br>
> workplace our trainer told us that most security breaches are due to<br>
> the actions of people within the organisation rather than outside of<br>
> it. This seems very plausible to me.<br>
<br>
People are almost always easier to manipulate or catch in error than<br>
systems are to crack through exploitation of technical flaws.<br>
<br>
How is this not exactly the same as a password? Or AWS credentials?<br>
Or a secret key? Or any other of a host of similar schemes?<br>
<br>
-Craig<br>
_______________________________________________<br>
erlang-questions mailing list<br>
erlang-questions@erlang.org<br>
<a href="http://erlang.org/mailman/listinfo/erlang-questions">http://erlang.org/mailman/listinfo/erlang-questions</a><br>
</div>
</span></font>
</body>
</html>