News for hackers. Stuff that matters.

A comment on Stealing passwords from McDonald's users. Parent comment

Re:Stealing passwords from McDonald's users by richthegeek on Monday January 16, 2017 @11:32AM (#13410917)
Does signing the cookie with secondary information such IP or UA help? I know they can both be spoofed, but it's an extra layer...
[ Parent | on HN ]
Re:Stealing passwords from McDonald's users by PeterisP on Monday January 16, 2017 @03:19PM (#13412668)
Signing the cookie with IP would break the site for everyone with changing IPs, e.g. mobile users on cellular networks. Web site sessions should persist across IPs.
[ Parent | on HN ]