3 ms·

I'd be very careful counting the requirements for cookies as a bad thing (as seen in the github section): First-Party session cookies are a totally valid use o

by pilif 14y ago

I'd be very careful counting the requirements for cookies as a bad thing (as seen in the github section): First-Party session cookies are a totally valid use of cookies and actually help improving the security in that a session-id in a cookie will never be copy & pasted by accident (it happens to URL-based session-id's at times) and cookies can be marked as both httponly and secure, making it more difficult to impossible (depending on browser) to XSS the session-id away. As such I would actually go as far as to prefer a site that requires (first-party session) cookies to one that doesn't.

deleted 14y ago
[deleted]
hugoroy 14y ago
Thanks for your feedback. The whole explanation can be found about cookies can be found here. Tell us what you think! http://tos-dr.info/topics.html#cookies http://tos-dr.info/topics.html#cookies > 5 GitHub requires cookies 5: means it's a low score. So it's considered bad, but it doesn't influence very much the whole class of GitHub. > GitHub requires cookies to work and misleads you to > believe that you remain anonymous while cookies contain > “unique identifiers”. However, only session cookies are > used, not persistant cookies. The whole discussion is here https://groups.google.com/d/topic/tosdr/gyMiAkV5ZG0/discussion https://groups.google.com/d/topic/tosdr/gyMiAkV5ZG0/discussi... Do you agree/disagree? We welcome contributions!
- bierko 14y ago
  Not to be a stickler, just trying to help, but persistant is misspelled (persistent).
  - hugoroy 14y ago
    Not at all ;) thanks (not a native English speaker)
Lockyy 14y ago
Url based session ids led to me finding a quite substantial security hole in a popular games mod website that allowed me to modify and delete my mods without being logged in. Also was able to view my own download history, potentially very embarrassing for some people. So yes, I can testify that in this websites case their use of session ids in the url during a website renovation (where people were posting their urls on the forums to help fix bugs) led to a lot of people being made vulnerable. I just wish they'd at least thanked me for informing them of the vulnerability...

by pilif 14y ago

deleted 14y ago

[deleted]

hugoroy 14y ago

Thanks for your feedback. The whole explanation can be found about cookies can be found here. Tell us what you think! http://tos-dr.info/topics.html#cookies http://tos-dr.info/topics.html#cookies > 5 GitHub requires cookies 5: means it's a low score. So it's considered bad, but it doesn't influence very much the whole class of GitHub. > GitHub requires cookies to work and misleads you to > believe that you remain anonymous while cookies contain > “unique identifiers”. However, only session cookies are > used, not persistant cookies. The whole discussion is here https://groups.google.com/d/topic/tosdr/gyMiAkV5ZG0/discussion https://groups.google.com/d/topic/tosdr/gyMiAkV5ZG0/discussi... Do you agree/disagree? We welcome contributions!

bierko 14y ago
Not to be a stickler, just trying to help, but persistant is misspelled (persistent).
- hugoroy 14y ago
  Not at all ;) thanks (not a native English speaker)

Lockyy 14y ago

Url based session ids led to me finding a quite substantial security hole in a popular games mod website that allowed me to modify and delete my mods without being logged in. Also was able to view my own download history, potentially very embarrassing for some people. So yes, I can testify that in this websites case their use of session ids in the url during a website renovation (where people were posting their urls on the forums to help fix bugs) led to a lot of people being made vulnerable. I just wish they'd at least thanked me for informing them of the vulnerability...