News for hackers. Stuff that matters.

A comment on RFC 6896 – Secure Cookie Sessions for HTTP.

Re:RFC 6896 – Secure Cookie Sessions for HTTP by kpcyrd on Thursday December 20, 2018 @04:11PM (#18729155)
It seems this has all disadvantages of jwt-style sessions, plus a BREACH-style vulnerability in the crypto due to compression if `plain-text-cookie-value` contains data an attacker can taint.
[ Parent | on HN ]
Re:RFC 6896 – Secure Cookie Sessions for HTTP by tptacek on Thursday December 20, 2018 @06:56PM (#18730349)
Yeah, I'm pretty confused by this being on the front page.
[ Parent | on HN ]
Re:RFC 6896 – Secure Cookie Sessions for HTTP by ryacko on Thursday December 20, 2018 @06:59PM (#18730364)
Worse: “SCS doesn't address replay of old cookie values.”
[ Parent | on HN ]