News for hackers. Stuff that matters.

A comment on Stealing passwords from McDonald's users. Parent comment

Re:Stealing passwords from McDonald's users by jdmichal on Monday January 16, 2017 @09:15AM (#13410055)
To answer your question about monkeying: Sign the cookie! We sign session cookies with HMAC, and reset the session if it doesn't match. Doesn't handle replay attacks, but you at least know that you're getting back the same data that you gave the client.
[ Parent | on HN ]
Re:Stealing passwords from McDonald's users by jessaustin on Monday January 16, 2017 @04:28PM (#13413187)
Doesn't handle replay attacks...

This is why we have CSRF tokens, right? Orthogonal to session cookies, but when used together they avoid this vuln.

[ Parent | on HN ]
Re:Stealing passwords from McDonald's users by richthegeek on Monday January 16, 2017 @11:32AM (#13410917)
Does signing the cookie with secondary information such IP or UA help? I know they can both be spoofed, but it's an extra layer...
[ Parent | on HN ]
Re:Stealing passwords from McDonald's users by PeterisP on Monday January 16, 2017 @03:19PM (#13412668)
Signing the cookie with IP would break the site for everyone with changing IPs, e.g. mobile users on cellular networks. Web site sessions should persist across IPs.
[ Parent | on HN ]