2 ms·
What about MITM attacks? Seriously, if you want security, use SSL.
by newt0311 18y ago
What about MITM attacks?
Seriously, if you want security, use SSL.
- JulianMorrison 18y agoSSL solves a different problem. Problem 1: protection from session hijack across a series of requests. Solution: tickets. Problem 2: protection from interception and alteration of the commands within one request. Solution: SSL. SSL (even in its most powerful form as a password-protected client-side CA-signed cert!) provides no protection against problem 1.
- ajross 18y agoA man in the middle attack won't defeat a signed "cart" object stored in the client's browser. The signature's private key is stored on the server and never appears on the network. This requires no per-session state on the server, just a single key pair. SSL, on the other hand does nothing to prevent a cross-site attack. Anything that can run code in the client browser can in principle cause it to send a fraudulent shopping cart "securely" to the server.