3 ms·

Yes to what exactly?

• alecco 16y ago
  >>> If I understand the exploit correctly, attackers are able to make >>> a series of bad requests, record the error page display timing, >>> and eventually figure out the machine key used for AES encryption. Yes. >>> I don't use ViewState any more, having moved on to ASP.NET MVC (From my inherently limited understanding) this is not just ViewState. That's just one of the multiple things vulnerable. I think they also mentioned ASP.NET MVC being vulnerable, too.