News for hackers. Stuff that matters.

A comment on Is it OK to hold credit card numbers in cookies, Santander?. Parent comment

Re:Is it OK to hold credit card numbers in cookies, Santander? by dgoodlad on Monday October 15, 2012 @04:04PM (#4656908)
That's how _some_ session tracking works. See Rails' CookieStore strategy for session storage for example: http://guides.rubyonrails.org/security.html#session-storage

> Rails 2 introduced a new default session storage, CookieStore. CookieStore saves the session hash directly in a cookie on the client-side. The server retrieves the session hash from the cookie and eliminates the need for a session id. That will greatly increase the speed of the application, but it is a controversial storage option and you have to think about the security implications of it:

[ Parent | on HN ]
Re:Is it OK to hold credit card numbers in cookies, Santander? by chris_wot on Monday October 15, 2012 @04:16PM (#4656957)
That's not how secure session management works.
[ Parent | on HN ]
Re:Is it OK to hold credit card numbers in cookies, Santander? by cheald on Monday October 15, 2012 @11:38PM (#4658353)
It's plenty secure in the sense that you can't forge a session. It's not secure in the sense that the data is inaccessible if you know how to base64 decode a cookie.

If you're using cookie sessions, you should know better than to store sensitive information in the session.

[ Parent | on HN ]
Re:Is it OK to hold credit card numbers in cookies, Santander? by chris_wot on Tuesday October 16, 2012 @06:00AM (#4659049)
In other words, because they are holding sensitive information in their cookies encoded only via base64 it's not secure. In other words, what I said.
[ Parent | on HN ]