Skip to main content

Be secure with SessionBox

By
A large percentage of web based attacks can be avoided with careful planning and implementation of the website's code. However, a large portion of attacks directly target the user's browser, where the protection imprinted into the server side architecture is many times not enough. This is the area where SessionBox helps you.

A number of different attack methods base their attack vector on the fact, that users are already logged into other websites. Let's take an example. You are probably logged into Facebook. When you visit a site - let's call it example.com - this site runs many scripts inside your browser. Where you have active sessions for Facebook.com. This means that example.com can for example send requests to Facebook.com - where you are already authenticated - and make actions on your behalf. Moreover, example.com might be a trusted site, but they can also be attacked, and if they are not prepared against XSS attacks, a savvy hacker can inject their script, which will in the end run in your browser.
https://stackoverflow.com/tags/xss/info
This is a long topic, and not as simple as shown in the previous paragraph. There are methods to limit which sites can send requests to Facebook.com - or any webpage. But there exist other vectors, on the same principle. Like, forging a simple link which will send a GET request to a site on your behalf, or simply inserting a website in a frame (Facebook.com and well-designed sites prevent this), and setting an image, or a small game over it, which will hide the fact that you are truly clicking inside your account.


And what can we do?
Well, the root cause of this attack vector is the fact that browsers have a common storage for cookies, and thus to active sessions. So, don't use them... Set up a SessionBox-managed session for your trusted, personal accounts - eg. a 'Personal' profile -, create one for 'Work', and use the browser without a logged-in account, that you want to truly protect. Or the other way around, use your browser as a secure, trusted zone, and open up all other, less-trusted sites in SessionBox sessions. Either you choose, you will definitely live in a more secure digital world.

Comments

Post a Comment

Popular posts from this blog

By
An introduction to SessionBox - what's this and why we are doing it? Develop web applications, test new features, log out of personal Gmail, log in with a test account, then repeat to check with another one. Probably use different browsers, or Chrome profiles, so that I won't need to re-login for every test. Quite a pain. Mainly this continuous context switching and re-login (mostly even with 2FA) was the reason why we started thinking about finding a solution, that could persist different contexts in one single browser, using different tabs. And that's exactly what SessionBox does. Handle both Personal and Work related sessions in the same browser window. Eg. multiple Google / Gmail accounts can be easily used at the same time. Our pain of dealing with continuous user context switching lead to a hobby project, that has already reached over 38.000 downloads, and more than 25.000 monthly active users. This was the number at which we thought this might lead ...
1 comment
Read more

Share access without giving away your password with SessionBox

By
Share your sessions Did you ever wish to pass over one of your accounts to a friend of yours? Or is your company using shared accounts for your daily activities? Well, there are some solutions, but all of those include sending over your password to the other party - sometimes client side code tries to hide this fact, but any savvy user can easily get around that. With our latest release (1.0.35) we have added a new feature, called Session sharing. With this brand new possibility we provide a new way of sharing your accounts, without sharing the password itself. Moreover, you can limit the timespan of the sharing itself, so if you just want to show something to your friends, you can give them access for an hour, then they won't be able to access your account again. How to start sharing? Open up the context menu for the session you wish to share. You can see a new item here, called "Share..." Select the domains you want to share. Browsing around on t...
1 comment
Read more