0

I am developing an ASP.Net MVC 3 intranet site that will use Integrated Windows Authentication exclusively. What are the vulnerabilities of the challenge/response authentication traffic being sent in plain text? Will someone sniffing the network traffic be able to hijack an authenticated session?

Improve this question

1 Answer 1

Reset to default
1

NTLM is probably one of the better options you've got in terms of authenticating in the clear, but you still have plenty of vulnerability if you aren't encrypting the transport layer, even in a somewhat trusted environment. Basically, if the data matters spend the extra $25 and get yourself a legit certificate.

Improve this answer
2
  • Thanks for the reply Wyatt. I have... a lot to learn about asp.net security, and most of my research seems to apply to asp.net with forms based security. I'd like to know, specifically, if the "Authorization:Negotiate" cookie that is used with Integrated Windows Authentication is vulnerable in the same way that the asp.net Session Id is (when sent over http). Most security warnings are concerned over a visible Session Id. If I'm not using ASP.Net sessions, and hence have no session Id,does the Authorization:Negotiate cookie present the same vulnerability?
    – jlnorsworthy
    May 28, 2013 at 23:33
  • 2
    that would be a good question to ask at security.stackexchange.com . It still doesn't cover the underlying issue that if someone is in place to hijack the session they can hijack the data. And if they can hijack -- and likely do significantly worse -- with the data all your authentication is pretty immaterial.
    – Wyatt Barnett
    May 29, 2013 at 0:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.