I think Jim is concerned with having the card present and having a hacker
maliciously query the smartcard subsystem for information. With the card
removed this is not possible. It is nice to use the card as a means of
logging out such as in the Sun Ray but at the same time it is really EASY
to query the serial number of the card on the Sun Ray cards while they are
in the machine. What's to stop me from then emulating that serial number
on another card and stealing someone's session ? Also, the application may
not have RESET the card on exit. This would mean the card would still have
PIN and AUT priveledges in many cases if they were previously successfully
entered. As an attacker I can now send requests to the smartcard subsystem
in many cases to get a digital signature from that person.
These are just some possibilities of attack, though I do agree having the
card internal is really useful for ending sessions. There is still the
chance the user will leave their card in the reader which then a timeout
would be best.
Regards,
Dave
>On Fre, 26 Mai 2000, Jim Rees wrote:
>> Another problem is that you really don't want (or at least I don't want) the
>> card to be present in the reader during the entire session. I want to
>> insert the card, have it log me in, then remove the card. Now I stay logged
>> in until I log out, either explicitly or by timeout. That means the card
>
>Why don't you like your card being present during the session? If you pull
>out the card, you get logged out -- why not?
>
>Cheers,
>Harald
>
>***************************************************************
>Linux Smart Card Developers - M.U.S.C.L.E.
>(Movement for the Use of Smart Cards in a Linux Environment)
>http://www.linuxnet.com/smartcard/index.html
>***************************************************************
David Corcoran Purdue University
1008 Cherry Lane
West Lafayette, IN 47906
[EMAIL PROTECTED]
765 - 427 - 5147 http://www.linuxnet.com
***************************************************************
Linux Smart Card Developers - M.U.S.C.L.E.
(Movement for the Use of Smart Cards in a Linux Environment)
http://www.linuxnet.com/smartcard/index.html
***************************************************************
