News for hackers. Stuff that matters.
Re:Show HN: WebSession, a Secure Replacement for Cookies by tfigueroa on Monday October 23, 2023 @10:09PM (#37994166)
I thought I was misreading this. It seems onerous to keep track of every nonce, even scoped to a given session. Maybe I’m missing something.
Re:Show HN: WebSession, a Secure Replacement for Cookies by kortex on Tuesday October 24, 2023 @12:43AM (#37994904)
A Bloom or cuckoo filter would allow for efficient tracking of nonces (depending if the security model prefers false positives with 4xx/resend, or false negatives)
Re:Show HN: WebSession, a Secure Replacement for Cookies by cryptonym on Tuesday October 24, 2023 @03:45AM (#37995905)
Still not ideal in a distributed environment, a request may have to synchronously go around the world to hit that nonce db.