3 ms·
Ohh, I missed the problem with dynamic IPs. But what about MAC-address, why browsers don't bind the cookie to the MAC-address of the computer?
by pankratiev 16y ago
Ohh, I missed the problem with dynamic IPs. But what about MAC-address, why browsers don't bind the cookie to the MAC-address of the computer?
- mooism2 16y agoBrowsers? You mean web servers, surely? Servers don't know the client's mac address.
- pankratiev 16y agoIn the post I meant server-side, in my comment I meant client-side. The general question - why not to bind the cookie to some other identifier of the user or user's computer to make cookie useless in thief's hands.
- mooism2 16y agoIn general, the attacking computer can pretend to have the characteristics of the impersonated computer.
- Khao 16y agoThen again, if someone would go the lengths to hack into someone else's account, I think it's possible to spoof a MAC-address.
- pankratiev 16y agoYou are right, in the case of Facebook in Tunisia - providers could inject the code which store user's cookie and MAC-address. My idea is useless. :-(
- ewams 16y agoThere is no way the server would know the mac address of the client unless the browser stores and shares that information. This is not how currently implemented networking protocols work.