SSLFakeBasicAuth ??

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • Volantt
    Confirmed User
    • Nov 2003
    • 745
    #1

    SSLFakeBasicAuth ??

    A customer of mine and I are fooling around with using SSLFakeBasicAuth to log users in to a paysite. Has anyone ever used this method before? Interested in implementing it and was wondering about some feedback on the pros and cons.

    Only draw back is the user has to access the site from the computer the Certificate is loaded on after sign up.

    But it would basically kill all brute force attacks and password sharing.

    I have used it before with a plug-in site to secure access between the two sites. Worked quite well.

    More info:
    http://slwww.epfl.ch/SIC/SL/CA/access_control.html

    Any opinions on this is appreciated.

    V
    "Only the dead have seen the end of war." - Plato
    "In the abscence of orders, go find something and kill it." - Erwin Rommel
    "A man's worth is no greater then the worth of his ambitions." - Marcus Aurelius
    Tags: None
    • SGS
      Confirmed User
      • Dec 2002
      • 5176
      #2
      Sounds interesting but how much trouble would it be to impliment?
      See sig...

        Comment

        • Volantt
          Confirmed User
          • Nov 2003
          • 745
          #3
          Originally posted by SGS
          Sounds interesting but how much trouble would it be to impliment?
          Not really hard at all, since PHP and OpenSSL are fully intergrated. Just after the customer signs up they would need to load a unique certificate that is generated for them into the browser.

          Then when they visited https://www.somesite.com/login.php the certificate data would be retrieved and you could validate the session in mySQL and serve the content through normal http protocol.

          The hard part would be to rewrite the API for the credit card processor to add/delete certificates from the access file when the membership is up.


          V
          Last edited by Volantt; 12-12-2003, 11:48 AM.
          "Only the dead have seen the end of war." - Plato
          "In the abscence of orders, go find something and kill it." - Erwin Rommel
          "A man's worth is no greater then the worth of his ambitions." - Marcus Aurelius

            Comment

            • Volantt
              Confirmed User
              • Nov 2003
              • 745
              #4
              Was looking for opinions on limiting users of paysites to only one computer system. That I think is not going to be worth it but wanted paysite owners opions on it.

              V
              "Only the dead have seen the end of war." - Plato
              "In the abscence of orders, go find something and kill it." - Erwin Rommel
              "A man's worth is no greater then the worth of his ambitions." - Marcus Aurelius

                Comment

                • NetRodent
                  Confirmed User
                  • Jan 2002
                  • 3985
                  #5
                  We looked into this option a while back. We discarded it because we feared that having to install a certificate would be too confusing for most porn surfers.
                  "Every normal man must be tempted, at times, to spit on his hands, hoist the black flag, and begin slitting throats."
                  --H.L. Mencken

                    Comment

                    • fsfaz
                      Confirmed User
                      • Apr 2003
                      • 747
                      #6
                      Yup. If they are *buying* porn, they aren't very computer or net saavy.

                        Comment

                        Previous template Next
                        Working...