3 ms·

Obviously, it is possible to break unsigned cookies. However good luck with dictionary attack protection, session-id, ssl, most banking sites are mandated to h

• alecco 16y ago
  From my understanding, the attack guesses the key used by the server. And in most cases the same key is used for almost everything. So they can guess it with something trivial and then use it to make a fake cookie or encrypted form element to get access. SSL and session ids have nothing to do with the padding oracle attack itself.