News for hackers. Stuff that matters.

A comment on SSL broken. (TLS 1.0 cryptographic attack that works. Not just fake certs.). Parent comment

Re:SSL broken. (TLS 1.0 cryptographic attack that works. ... by rorrr on Monday September 19, 2011 @08:18PM (#3015745)
If somebody injects JS into your stream, you are most likely screwed, but it doesn't mean your cookies can be stolen. Cookies can be set to HttpOnly (and should be, if you're trying to operate a secure site).
[ Parent | on HN ]
Re:SSL broken. (TLS 1.0 cryptographic attack that works. ... by ajross on Tuesday September 20, 2011 @12:51AM (#3016335)
You're in luck! I have a Chrome extension that prevents just that. Let me send you a copy you can install for yourself...
[ Parent | on HN ]
Re:SSL broken. (TLS 1.0 cryptographic attack that works. ... by alecco on Tuesday September 20, 2011 @12:02AM (#3016215)
+Secure flag to block sending the cookies over plain HTTP.
[ Parent | on HN ]
Re:SSL broken. (TLS 1.0 cryptographic attack that works. ... by itsnotvalid on Tuesday September 20, 2011 @01:20AM (#3016383)
I am guessing that they are able to bypass this restriction.
[ Parent | on HN ]
Re:SSL broken. (TLS 1.0 cryptographic attack that works. ... by alecco on Tuesday September 20, 2011 @03:38PM (#3019244)
No, the attack is against SSL and Man-in-the-Middle. They just make the browser send SSL requests with those cookies, and then guess the cookie (sent inside the SSL session).
[ Parent | on HN ]