Tag Info

New answers tagged

0

By trial and error I found the answer: It seems that when SSL is used (test 2), setcookie is required as follows: setcookie('sessionname', session_id(), time()+whatever, '/', 'theSSLhostaddress', true, true or false); Also, the htaccess works in test 2. The non-SSL script (test 1) did not require setcookie! Hope this helps.


3

Cookies are domain-dependent. You don't decide, from the server side, which cookie you read; the browser sends the stored cookies that match the name (with domain) of the target server. If you want to share some authentication in some SSO manner, then you need both servers A and B to delegate the authentication to a common third server C. That server will ...


4

Unless "website A" and "website B" are both subdomains of the same domain, what you want to do is impossible; if they are subdomains of the same domain, the same person or organization presumably controls both. Consequently, legality is irrelevant.


0

If you are passing authorisation token via http headers then you need to have a client side logic to pass this to server every time you make a request. A skimmer can look for this in your client side code and can hijack your user session with Java script. But if the same info is passed via cookies then it is the browsers responsibility to pass the cookie ...


2

Cookies are used to retain information between visits to a website. This gives website the ability to remember you between visits. This allows them to provide better service, but also gives them the opportunity to analyze your long-term behavior. Disabling cookies is a tradeoff between privacy and convenience. You have to decide for yourself if you want to ...


13

Usually, the password isn't stored in the cookie. You login to example.com with your username and password, these are verified to belong to you (typically by hashing your password and checking the hash of your password matches with the hash for a user with that username), and the server issues you a long random number token as a secret identifier for you. ...


3

In the case of CRIME, the attack is on the client. Hostile Javascript in the client triggers requests to the server, that the attacker observes from the outside; and (that's the important point here) the attacker can block the outgoing request. The attacker needs to see the encrypted records, but not necessarily to let them go all the way to the server. ...


0

An application should rely upon the platform's session handler. Rolling your own session handler is dangerous. A cookie can be scoped to the parent domain and used by every sub-domain. In PHP this can be done with session_set_cookie_params() to change the scope the domain to *.example.com. Then use session_start() normally. XSS on any subdomain may ...


8

There are 2 main reasons why cookies are easier to steal than login credentials: Cookies are sent for every request, login credentials are only sent once for each "session" If you sniff a network, it is less likely that you will be in place at the point when a user actually perform a login using its username and password. Cookies on the other hand, are ...


3

If the username and password were sent in plaintext, then yes, sniffing them is a better option. However, a common pattern is for the login process to be encrypted (for security), and then the remainder of the session takes place in the clear (because encryption imposes a bit of a performance penalty). In such a case, the username and password cannot be ...


3

Avoiding the tracking codes is most important for sites to which you don't identify yourself / your device anyway, i.e., anonymous surfing. Using Tor is the best option since you don't have to trust any VPN provider. VPN is the second best, and you can probably find a VPN provider that you trust as at least somewhat more than your mobile carrier. Third best ...


10

The easiest way to avoid interception/modification of your web traffic is one that you mention in the question which is to use a VPN. This will encrypt traffic between your device and the VPN endpoint and should prevent your ISP from being able to modify web headers or other aspects of your use. There are VPN clients for most modern mobile operating ...



Top 50 recent answers are included