News for hackers. Stuff that matters.
Re:Twitter Security Issue by aston on Monday November 24, 2008 @03:19AM (#374582)
The fix for this sort of thing is pretty simple. Just keep a nonce on a user (the "user version" if you will) that increments every time a user makes a change to their login credentials, store that nonce in their cookie, and if the one in the cookie is lower than the one on the server treat it as a logout.

That said, this is sort of an unserious security "issue" for most people between not really caring about the security of their account and reasonably short cookie lifetime settings.

There are no comments on this comment yet.