News for hackers. Stuff that matters.

A comment on SSL broken. (TLS 1.0 cryptographic attack that works. Not just fake certs.). Parent comment

Re:SSL broken. (TLS 1.0 cryptographic attack that works. ... by alecco on Tuesday September 20, 2011 @12:02AM (#3016215)
+Secure flag to block sending the cookies over plain HTTP.
[ Parent | on HN ]
Re:SSL broken. (TLS 1.0 cryptographic attack that works. ... by itsnotvalid on Tuesday September 20, 2011 @01:20AM (#3016383)
I am guessing that they are able to bypass this restriction.
[ Parent | on HN ]
Re:SSL broken. (TLS 1.0 cryptographic attack that works. ... by alecco on Tuesday September 20, 2011 @03:38PM (#3019244)
No, the attack is against SSL and Man-in-the-Middle. They just make the browser send SSL requests with those cookies, and then guess the cookie (sent inside the SSL session).
[ Parent | on HN ]