5 ms·
It's that assumption, literally: if the attacker had managed to steal your session information from the browser, then they would not be able to use it since the
by heavenlyblue 7y ago
It's that assumption, literally: if the attacker had managed to steal your session information from the browser, then they would not be able to use it since they would also need to share my IP.
In real life if the attacker is capable of stealing my session credentials the chance of them _not_ being able to tunnel through my local network is infinitesimal.
- VBprogrammer 7y agoThe thing is though, what they seemed to object to was trying to login (not using the same session cookie) across different IP addresses. At least that was the case when I opened the site on my laptop. Maybe my phone did login on the dodgy wifi and then when I reconnected via the 4g it tried to use that session, perhaps causing my account to be flagged. I'm not really convinced though. It clearly makes sense to tie the session to the IP address but the 10 minute delay doesn't make much sense to me.
- nybble41 7y ago> It clearly makes sense to tie the session to the IP address... At one point that might have been true but not any more. Mobile devices are the norm, and handoffs between cell towers and WiFi access points are handled transparently without any user interaction. Consequently, people expect their sessions to continue working despite changes in their IP address. Use TLS connections and set expiration times on the session cookies, but ignore the source IP address.
- rtkwe 7y agoYour IP doesn't change per tower transition, your data from the tower goes through more centralized servers. For example my IP sitting physically in RTP in North Carolina is actually exiting AT&Ts network in Atlanta, Georgia.
- nybble41 7y agoFor clean handoffs within the same network, sure. But you also have roaming to consider, and the device may lose its connection temporarily and be assigned a new address when it returns.
- wool_gather 7y agoIs there actually any advantage to having a dynamic pool of IP addresses like this? Associating a number from your IP block to a subscriber number seems far, far simpler and better.
- mnoorenberghe 7y agoIf you’re suggesting each subscriber gets a static IP then that’s much worse for privacy.
- wool_gather 7y agoI'm speaking from the provider's point of view: they don't care about privacy. In fact, in the US there is a federal law that requires them to be able to associate network activity with a subscriber at the request of law enforcement.
- zAy0LfpBZLC8mAC 7y agoLocality/size of routing tables. If you had a hundred million subscribers with fixed IP addresses moving all over the country, you essentially could not aggregate any routes, but would have to have a hundred million routes in your routing table, and/or you would have to push all the traffic from and to all subscribers through one central router, which in particular would add latency for any subscribers that currenty are at the other end of the country.
- Spooky23 7y agoYour cellular traffic is proxied in most cases, and how carriers present it varies.
- dsfyu404ed 7y ago>In real life if the attacker is capable of stealing my session credentials the chance of them _not_ being able to tunnel through my local network is infinitesimal. In real life each "trivial" filter like this cuts down a substantial number of potential attackers. Defense in depth. When there's a ton of hoops to jump through attackers go find a different target.
- heavenlyblue 7y agoNah, in real life it constantly batters the system administrators with unnecessary alarms who then stop taking them as seriously as they should be if they were actual attacks.