25,916 reputation
971110
bio website
location Finland
age
visits member for 1 years, 5 months
seen 1 hour ago

I work with security stuff and I enjoy it. You can reach me on: adnan.stackexchange[*at*]live[*dot*]fi


1h
reviewed Close Check if i'm using a filtered network
1h
reviewed Close Security jobs that suit disabled workers
1h
reviewed Leave Open NTP DDoS Attack on Home Servers
1h
reviewed Close Access control on a primarily windows LAN
1h
reviewed Close Increase hydra brute force login attempts
1h
reviewed Close Cryptosytem Question
1h
reviewed Close What is a good way to be alerted of major security patches for software I use?
19h
reviewed Close Most secure SSH server
22h
reviewed Approve suggested edit on How different should passwords be?
22h
reviewed Approve suggested edit on Why is OAuth 2.0 being used for mobile devices, and not OpenID?
1d
comment How to avoid session sharing inside the same network
"I was thinking about a situation to avoid session sharing or hijacking" ... "someone from inside the same network copied (or hijacked) the cookie to another machine."
1d
comment How to avoid session sharing inside the same network
You can try to use browser fingerprinting techniques, but in the end you're trying to achieve something that isn't possible. You cannot protect against users voluntarily sharing the same cookie in the same network. All of your identifying information are client-supplied.
1d
comment How to avoid session sharing inside the same network
Duh! Which is what you should tell the OP in your answer. Regardless of it being a good advice or not, your answer does not address the question. In this site, we answer questions.
1d
comment How to avoid session sharing inside the same network
This protects from malicious hijacking of the cookie in-the-wire. It doesn't address issues of hijacking from the machine itself, or (as per OP's question) normal copying of the cookie value from one browser to another.
1d
reviewed Approve suggested edit on Personal details and last 4 digits of credit card
1d
comment Is there a general name for this sort of cryptographic protocol?
@user45218 With that, you're essentially describing an MiTM attack, which is what the whole PKI thing is designed to prevent.
1d
reviewed Close How do I ensure programs ask for permission to access the internet?
1d
reviewed Approve suggested edit on Is hashing a DLL useful to protect from DLL hijacking?
1d
revised How do big companies ensure that other people don't register a new top level domain with their name?
edited tags
1d
revised Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?
added 1 character in body