News for hackers. Stuff that matters.

A comment on Robinhood Stored Passwords in Plaintext. Parent comment

Re:Robinhood Stored Passwords in Plaintext by londons_explore on Thursday July 25, 2019 @03:16AM (#20523339)
Session cookies should be locked to a TLS channel ID.

Then they are useless to anyone who steals them, since a TLS channel ID can't be recreated except with access to the TPM of the computer which initially created the cookie/session/TLS connection.

[ Parent | on HN ]
Re:Robinhood Stored Passwords in Plaintext by yread on Thursday July 25, 2019 @10:39AM (#20525731)
Can you post a bit more about how to do that? Your comment is a first result for my googling
[ Parent | on HN ]
Re:Robinhood Stored Passwords in Plaintext by SahAssar on Thursday July 25, 2019 @05:43AM (#20523971)
That requires support for token binding which google killed.
[ Parent | on HN ]