4 ms·

Are you concerned about using an old news.arc, with its somewhat-easy-to-steal auth token?

• jgrahamc 15y ago
  Are you talking about the timing based attack or the cookie in vote URL?
  • zachbeane 15y ago
    No, about using the user identification cookie value as the "auth" parameter for voting. http://xach.livejournal.com/228481.html http://xach.livejournal.com/228481.html
    • jgrahamc 15y ago
      I'll fix that myself.