3 ms·
And while everyone should have learned by now that there’s always some privacy risk when interacting online, hopefully the installation of Force-TLS will at lea
by po 16y ago
And while everyone should have learned by now that there’s always some privacy risk when interacting online, hopefully the installation of Force-TLS will at least put less of a damper on today’s stint at your local “free Wifi!” boasting cafe.
For most people there is a huge gap between "can read everything I write" and "can gain full control/impersonate me". On the technology side, these two things are unfortunately coupled. It is way more than a privacy risk.
If it were possible to pass the cookie on an encrypted channel but the content of the web page unencrypted this would match most people's idea of how it works. Unfortunately that's not the case.
- whakojacko 16y agoIf it were possible to pass the cookie on an encrypted channel but the content of the web page unencrypted this would match most people's idea of how it works. Unfortunately that's not the case. Has there even been any attempt to standardize something like this? This problem certainly isn't a new one, so I would have guessed this had been looked into before
- pornel 16y ago> Has there even been any attempt to standardize something like this? Yes. HTTP Digest authentication is an "encrypted cookie". The problem is that it only protects against passive sniffing. Attacker able to inject packets can bypass it (e.g. replace Digest with Basic auth.)