Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I am developing an ASP.Net MVC 3 intranet site that will use Integrated Windows Authentication exclusively. What are the vulnerabilities of the challenge/response authentication traffic being sent in plain text? Will someone sniffing the network traffic be able to hijack an authenticated session?

share|improve this question

1 Answer 1

NTLM is probably one of the better options you've got in terms of authenticating in the clear, but you still have plenty of vulnerability if you aren't encrypting the transport layer, even in a somewhat trusted environment. Basically, if the data matters spend the extra $25 and get yourself a legit certificate.

share|improve this answer
    
Thanks for the reply Wyatt. I have... a lot to learn about asp.net security, and most of my research seems to apply to asp.net with forms based security. I'd like to know, specifically, if the "Authorization:Negotiate" cookie that is used with Integrated Windows Authentication is vulnerable in the same way that the asp.net Session Id is (when sent over http). Most security warnings are concerned over a visible Session Id. If I'm not using ASP.Net sessions, and hence have no session Id,does the Authorization:Negotiate cookie present the same vulnerability? –  jlnorsworthy May 28 '13 at 23:33
2  
that would be a good question to ask at security.stackexchange.com . It still doesn't cover the underlying issue that if someone is in place to hijack the session they can hijack the data. And if they can hijack -- and likely do significantly worse -- with the data all your authentication is pretty immaterial. –  Wyatt Barnett May 29 '13 at 0:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.