4 ms·
Assuming that they use a strong enough cookie (eg, containing a randomized unique key that's verified by the server) and all connections are made over SSL, it s
by nuclear_eclipse 17y ago
Assuming that they use a strong enough cookie (eg, containing a randomized unique key that's verified by the server) and all connections are made over SSL, it should basically be as resistant to remote attack as the person's cellphone (eg, SIM chip spoofing to get two cells on the network under the same call number).
I say that here, the weak points are the user and the cellphone; I think that the barriers to usage that the site sets up will most likely deter all but the most paranoid users from using it.
- tptacek 17y agoUnless you're incompetant, cookies aren't compromised by guessing them or by scooping them off the wire. They're compromised by cross-site scripting and XSRF attacks.
- nuclear_eclipse 17y agoI know XSS and CSRF are security issues for the attacked site (had to deal with that stuff with MantisBT somewhat recently), but can you enlighten on how XSS or CSRF can compromise your cookies for a third party site? I didn't realize that was possible.