New answers tagged

1

Q1 - Preventing Session Fixation - MAC or Hash? Q2 - What is lost if the MAC is replaced by unkeyed hash? Q3 - Is there a weakness with this approach (of replacing MAC with a hash)? You identified the drawback of key management with using MAC across multiple servers whereas with unkeyed hash the only drawback is increased risk of session forgery due to ...


0

Within the scope of the article, the point is that there are 2 different methods by which Mallory gains control over Alice's session. Where the methods differ is when you consider the larger world in which such an attack may occur. if Mallory can get Alices to click on a link and the target system allows session ids to be set from a URL, then Mallory can ...


2

Mallory doesn't want Alice's session id. Mallory wants Alice to perform actions as herself, but while the website thinks she's Mallory. Like use her credit card to buy something she thinks she'll get, but which will actually be credited to Mallory. There are several vectors for this attack. The one you mention, cookie-less sessions with the session id in ...



Top 50 recent answers are included