I think they mean the session cookies.
There are pictures of a program where there is a cookie
"ACTIVE4DSESSIONID"
Then there is a program window cookie information with the value
(some encoded stuff with numbers and chars (16).
There are fields expires : 1970-01-01 01:00:00 Last called :
2007-07-30 10:39:11
If I look at my browser (camino, Firefox, safari) the expires reads
"end of session".
And after a restart of the program, there gone.
Okay, here are a few things to tell you client:
1. They need to fire this external security firm, they have no idea
what they are talking about.
2. Active4D session cookies ARE "temporary cookies". They disappear
when the session ends or the browser is quit. Some browsers might
keep such cookies only in memory, others might write the cookies to
disk, but they are deleted when the cookie expires.
3. There is NO, I repeat ****NO**** security risk from the Active4D
session cookie. It contains NO personal information. It contains only
a highly encrypted number used to identify a session.
4. Do a google search for "cookie security". EVERY SINGLE REFERENCE
says that cookies by themselves are no security threat. Using
Internet Explorer (or Windows, for that matter) is a security threat.
Cookies are not. If your client's so-called security firm says
otherwise, they are only proving their ignorance.
5. From what I have seen of the site, no one is logging in, so I'm
not sure why you need a session at all.
6. If a user does login to a secure area, you MUST use either use a
cookie or a session id in the URL to identify the user's session.
This is standard practice. Every secure site on earth does this. ALL
of my banks use cookies for session ids in their online banking
sites. Do you seriously think they would use session cookies if it
were such a security risk?
7. The ONLY way for a cookie to be insecure is if:
- Someone is sniffing your internet connection and capturing
the session id
- AND you are not using SSL (https) for secure login
- AND the attacker logs in before the session expires or the
user logs out
It is EXTREMELY unlikely for these three things to occur. If
someone is sniffing your internet connection and you are not using
SSL for secure access, you have much bigger problems than cookies.
There are other possible ways to attack a site, but from my testing
Active4D is not vulnerable to them.
8. It sounds like this so-called security firm ran some off-the-
shelf, brain-dead Windows-based security software at its strictest
setting. The software noticed a single cookie on your site, and since
on Windows cookies are used by spyware, a warning flag was raised.
They didn't even bother to notice (or weren't smart enough to
understand) that a cookie with an expiration date in the past (in
this case 1970-01-01 01:00:00) IS A TEMPORARY COOKIE.
9. See #1.
Regards,
Aparajita
www.aparajitaworld.com
"If you dare to fail, you are bound to succeed."
- Sri Chinmoy | www.srichinmoylibrary.com
_______________________________________________
Active4D-dev mailing list
[email protected]
http://mailman.aparajitaworld.com/mailman/listinfo/active4d-dev
Archives: http://mailman.aparajitaworld.com/archive/active4d-dev/
