8 reputation
2
bio website
location
age
visits member for 1 year, 1 month
seen Sep 3 '13 at 13:09

Nov
17
awarded  Student
Sep
3
comment What's wrong with my security model - or how can it be attacked?
I guess it would have been more clear to say that Username with a capital U, is the hashed version of username (the text someone enters in the username text field). This is just a small piece of obfuscation so nothing of merit is ever stored in plaintext. The SessionKey.Key is the real key, while the HashedUser is a link to the User table that key corresponds to. So not only do you have to have a valid session key, but it has to be valid for the username you are logged in as.
Sep
3
awarded  Scholar
Sep
3
accepted What's wrong with my security model - or how can it be attacked?
Sep
3
comment What's wrong with my security model - or how can it be attacked?
Okay cool, thanks for the breakdown. As far as Usernames go, yes one salt is used by the server, but it is only used on that one Table. The only way to get that would be if the server was compromised. No timestamps are ever saved, minus the inferred one-hour away SessionKey. I think passwords are okay that way accounts can be differentiated instead of 50 people using the same username and 2% of the time reading correct data. The AES Key is being saved in browser cache as Session data in the encrypted Cookie that goes back and forth. That may be a problem however.
Sep
2
asked What's wrong with my security model - or how can it be attacked?