[1273] in WWW Security List Archive
Re: SECURITY ALERT: Password protection bug in Netscape 2.0b3
daemon@ATHENA.MIT.EDU (Wayne Wilson)
Tue Dec 19 13:05:47 1995
Date: Tue, 19 Dec 1995 09:57:39 -0800 (PST)
From: Wayne Wilson <wwilson@umich.edu>
To: Jeff Treuhaft <jeff@netscape.com>
cc: www-security@ns2.rutgers.edu
In-Reply-To: <30D60DFD.4CE9@netscape.com>
Errors-To: owner-www-security@ns2.rutgers.edu
On Mon, 18 Dec 1995, Jeff Treuhaft wrote:
> The bug is that when a user gets an
> access denied response from a server (401 HTTP response) when requesting
> a protected document the Navigator means to delete the cached copy of
> that document, but the current beta versions do not. Thus, when a user
> hits the "back" button the program pulls the document out of the cache.
> Not intended behavior.
>
I am a little unclear about this description. From my reading I
conclude that a cached copy of a protected document is placed on local
disk and is then flushed when that document is revisited again? If that
is the case, then if the Navigator is exited before a revisit, the cached
protected document is still on disk and someone looking into the disk
cache files could find it again?
If the issue is one of making network performance optimizations (which
is not achieved if you flush before re-access!, then why keep it at all),
I would suggest the following compromize to keep the
cached document on disk: establish a session key and encrypt the
document with it. That way, when the browser is exited, the session key
is lost and the cached document is now unreadable ... but then you still
have to have a way to delete from the cache ... In the end, it would
seem simpler to just not cache protected documents in the first place.
