3 ms·
Ask HN: Why not to bind cookie to IP-address of the user? (Facebook and Tunisia)
This thought came when I read comments about Facebook, passwords and Tunisia http://news.ycombinator.com/item?id=2135563
In this case stealing the cookie will not so reasonable. And it can be easily implemented - just store key of the cookie with IP-address of the user on the server-side.
What do you think?
- Khao 16y agoIt's not possible to do this as with certain ISPs that assign dynamic IPs or inside large buildings that have multiple outgoing IPs, one user can have a different IP for different requests made at the same time.
- pankratiev 16y agoOhh, I missed the problem with dynamic IPs. But what about MAC-address, why browsers don't bind the cookie to the MAC-address of the computer?
- mooism2 16y agoBrowsers? You mean web servers, surely? Servers don't know the client's mac address.
- pankratiev 16y agoIn the post I meant server-side, in my comment I meant client-side. The general question - why not to bind the cookie to some other identifier of the user or user's computer to make cookie useless in thief's hands.
- mooism2 16y agoIn general, the attacking computer can pretend to have the characteristics of the impersonated computer.
- Khao 16y agoThen again, if someone would go the lengths to hack into someone else's account, I think it's possible to spoof a MAC-address.
- pankratiev 16y agoYou are right, in the case of Facebook in Tunisia - providers could inject the code which store user's cookie and MAC-address. My idea is useless. :-(
- ewams 16y agoThere is no way the server would know the mac address of the client unless the browser stores and shares that information. This is not how currently implemented networking protocols work.