Reputation
555
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
6 9
Newest
 Guru
Impact
~51k people reached

Feb
9
comment nf_conntrack: table full, dropping packet
These names may be different depending on your distro and kernel. You can discover their names by running sysctl --names --all | grep -i conntrack. Remember to edit /etc/sysctl.conf or your distro's local equivalent in order to make these settings stick!
Jan
12
awarded  Guru
Jul
24
awarded  Constituent
Jul
24
awarded  Caucus
May
30
awarded  Yearling
Jan
30
awarded  Good Answer
Dec
5
awarded  Citizen Patrol
Dec
5
awarded  Critic
Sep
6
awarded  Autobiographer
Aug
20
awarded  Caucus
Apr
24
awarded  Enlightened
Apr
24
awarded  Nice Answer
Apr
24
awarded  Yearling
Apr
24
comment Why is passing the session id as url parameter insecure?
You are more than welcome to provide your own answer, if you find mine lacking. I speak from extensive experience in the real world, not just from a purely security-oriented point of view. When supporting applications designed before developers understood the implications of such things, accidental session identifier passing was a far more visible, far more troublesome thing than the actual attack vector it presents. Now that it's well-understood to be an attack vector, steps must be taken to mitigate it.
Apr
24
comment Why is passing the session id as url parameter insecure?
@Rook, I prefer constructive feedback to downvotes. I've added a reference to session fixation attacks.
Apr
24
revised Why is passing the session id as url parameter insecure?
added 199 characters in body
Apr
23
comment Why is passing the session id as url parameter insecure?
And of course, neither is true if your browser is configured to either not save history/cookies or it's running in a privacy mode. However, that won't stop MitM attacks over unencrypted channels, and is only a minor barrier to spyware or malware attached to the browser from spying anyway.
Apr
23
awarded  Teacher
Apr
23
answered Why is passing the session id as url parameter insecure?
Sep
5
revised Is using HMAC to transmit a password OK?
No need to @somebody in an answer, especially when that somebody is the OP.