SessionLock: securing web sessions against eavesdropping

Proceeding of the 17th International Conference on World Wide Web 2008, WWW'08

Volumn , Issue , 2008, Pages 517-524

  Adida, Ben ^a  

^a HARVARD MEDICAL SCHOOL   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

CODES (SYMBOLS); INTERNET; JAVA PROGRAMMING LANGUAGE; SECURITY SYSTEMS; WIRELESS NETWORKS; WORLD WIDE WEB;

EMAIL SERVICES; JAVASCRIPT; LOGIN PAGES; PERFORMANCE IMPACTS; TRANSPORT LAYERS; UBIQUITOUS WIRELESS NETWORKS; WEB APPLICATIONS; WEB DEVELOPERS; WEB SESSIONS; YAHOO MAILS;

WEB BROWSERS;

EID: 57349150152     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1367497.1367568     Document Type: Conference Paper

References (19)

1. Ben Adida. BeamAuth: Two-Factor Web Authentication with a Bookmark. In Fourteenth ACM Conference on Computer and Communications Security (CCS 2007), November 2007.
2. Apache Software Foundation. SSL/TLS Strong Encryption FAQ Apache HTTP Server. http://httpd.apache.org/docs/2.0/ssl/ssl-faq. html#vhosts2 last viewed on 1 November 2007.
3. T. Berners-Lee, R. Fielding, and L. Masinter. Uniform Resource Identifier (URI): General Syntax, January 2005. http://www.ietf.org/rfc/rfc3986.txt.
4. S. Blake-Wilson, M. Nystrom, D. Hopwood, J. Mikkelsen, and T. Wright. Transport Layer Security (TLS) Extensions. http://www.ietf.org/rfc/rfc3546.txt.
5. Whitfield Diffie and Martin E. Hellman. New directions in cryptography. IEEE Transactions on Information Theory, IT-22(6):644-654, 1976.
6. R. Fielding, J. Gettys, J. Mogul, H. Frystyk, L. Masinter, P. Leach, and T. Berners-Lee. Hypertext Transport Protocol HTTP/1.1, 1999. http://www.ietf.org/rfc/rfc2616.txt.
7. J. Franks, P. Hallam-Baker, J. Hostetler, S. Lawrence, P. Leach, A. Luotonen, and L. Stewart. HTTP Authentication: Basic and Digest Access Authentication, June 1999. http://www.ietf.org/rfc/rfc2617.txt.
8. Jesse James Garrett. Ajax: A New Approach to Web Applications, February 2005. http://www.adaptivepath.com/publications/essays/archives/000385.php.
9. Robert Graham. Sidejacking with Hamster, August 2007. http://erratasec.blogspot.com/2007/08/ sidejacking-with-hamster-05.html.
10. R. Canetti H. Krawczyk, M. Bellare. Hmac: Keyed-hashing for message authentication, February 1997. http://tools.ietf.org/html/rfc2104.
11. Ian Hickson and David Hyatt. Html 5. http://www.w3.org/html/wg/html5/.
12. Collin Jackson and Helen Wang. Subspace: Secure Cross-Domain Communication for Web Mashups. In Proceedings of the 16th international conference on World Wide Web (WWW 2007), Banff, Canada, 2007.
13. Paul Johnston. A JavaScript implementation of the Secure Hash Algorithm. http://pajhome.org.uk/crypt/md5.
14. JotSpot. DojoDotBook. http://manual.dojotoolkit.org/WikiHome/DojoDotBook/ BookO.
15. Ari Juels, Markus Jakobsson, and Tom N. Jagatic. Cache cookies for browser authentication (extended abstract). In S & P, pages 301-305. IEEE Computer Society, 2006.
16. Message Authentication Code. http://en.wikipedia.org/wiki/Message- authentication-code.
17. Eric A. Meyer. S5: A Simple Standards-Based Slide Show System. http://meyerweb.com/eric/tools/s5/, last viewed on October 26th, 2006.
18. Bill Venners. HTTP Authentication Woes, April 2006. http://www.artima. com/weblogs/viewpost.jsp? thread=155252, last visited on October 31st 2007.
19. Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu. Finding Collisions in the Full SHA-1. In Victor Shoup, editor, CRYPTO, volume 3621 of Lecture Notes in Computer Science, pages 17-36. Springer, 2005.