4 ms·
Is the info about the Y and T cookies in this pdf [1][2] accurate? [1] (EDIT: now with screenshots) http://imgur.com/a/g61VZ http://imgur.com/a/g61VZ [2] (Not
by niftich 10y ago
Is the info about the Y and T cookies in this pdf [1][2] accurate?
[1] (EDIT: now with screenshots) http://imgur.com/a/g61VZ http://imgur.com/a/g61VZ
[2] (Not affiliated with link, but the risk-averse may wish to open in a sandbox) ftp://hackbbs.org/milworm/270
- jsjohnst 10y agoDoing a google search for the link showed me the title of the document which I remember reading in the past. The overall coverage of Y&T cookies is more or less accurate at the time of writing back in like 2010/2011, but there's a bunch of mostly minor technical inaccuracies too. I don't want to comment on much without rereading it, but I remember the description of Sled ID made me laugh (which btw I'd guess less than 1% of current Yahoo employees knows what that is).
- jsjohnst 10y agoAlso, the video that goes with the PDF is too funny! Just watched it on YouTube [0] again. Notice how he doesn't actually sign into Web Messenger, just goes to the login page? If he had, it would've failed. Same thing with him closing the browser before Yahoo Mail loaded. "Sensitive" reads and everything that did a write operation always (unless there was a bug) validated the cookie against the UDB. So even if you stole the signing key, without the values from the UDB, you would have very limited ability to do anything other than the trivial things shown in the video. [0] https://m.youtube.com/watch?v=n2CNp_zmje8 https://m.youtube.com/watch?v=n2CNp_zmje8