2 ms·
> Yes, that's just a Base64 encoded version of your password in a cookie and yes, it's being sent insecurely on every request and also yes, it's not flagged as
by lol768 4y ago
> Yes, that's just a Base64 encoded version of your password in a cookie and yes, it's being sent insecurely on every request and also yes, it's not flagged as "secure" therefore it's being sent in the clear.
The domain has HSTS enabled with a duration far exceeding the cookie lifetime. A cookie not being marked Secure does not imply that the cookie "is being sent in the clear" and I'm tired of security consultants implying otherwise. Do we know whether HSTS was set in 2017? Not for sure, but I'd bet some money on it being set.
- jwilk 4y agoThe Black and Decker story is from 2013. HSTS was rare back then. AFAICT the site didn't enable HSTS until late 2018: $ curl -Lis 'https://web.archive.org/web/201810/https://www.blackanddecker.com/' | grep -i '^x-archive-orig-strict-transport-security:' [nothing] $ curl -Lis 'https://web.archive.org/web/201811/https://www.blackanddecker.com/' | grep -i '^x-archive-orig-strict-transport-security:' x-archive-orig-strict-transport-security: max-age=86400 ; includeSubDomains