Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on How I could hack internet bank accounts of Danish largest bank in a few minutes. Parent comment
1) Log into a site on one computer
2) In the javascript console (tools->developer tools) type 'document.cookie'
3) On a separate computer visit the same site but don't log in. Open the javascript console.
4) Paste in the cookie, i.e document.cookie="keyofcookie=valueofcookie"
5) See if your authenticated using the account you 'stole' the cookie from without actually having to authenticate on the second computer
(Rather then using two computers, you could use two different browsers on the same computer)
Nowhere here was PKI used.
One way to mitigate this type of attack is to store the users IP address server side and detect if they change IPs during the same session.
There are no comments on this comment yet.
1) Log into a site on one computer
2) In the javascript console (tools->developer tools) type 'document.cookie'
3) On a separate computer visit the same site but don't log in. Open the javascript console.
4) Paste in the cookie, i.e document.cookie="keyofcookie=valueofcookie"
5) See if your authenticated using the account you 'stole' the cookie from without actually having to authenticate on the second computer
(Rather then using two computers, you could use two different browsers on the same computer)
Nowhere here was PKI used.
One way to mitigate this type of attack is to store the users IP address server side and detect if they change IPs during the same session.