News for hackers. Stuff that matters.

A comment on Fun with your friend's Facebook and Tinder sessions. Parent comment

Re:Fun with your friend's Facebook and Tinder sessions by neftaly on Tuesday December 16, 2014 @05:49PM (#8760082)
Cool – hadn't heard of that before. I was thinking more along the lines of a purely server-side approach:

  $_REQUEST["salted_SHA_hash_of_symmetric_TLS_key"]
You'd save the current key to a DB, and manually check it in future requests.
[ Parent | on HN ]
Re:Fun with your friend's Facebook and Tinder sessions by Mawaai on Wednesday December 17, 2014 @07:15AM (#8762002)
Well, if you can intercept the request to the server to can also change that parameter of the TLS certificate hash.
[ Parent | on HN ]
Re:Fun with your friend's Facebook and Tinder sessions by neftaly on Wednesday December 17, 2014 @03:15PM (#8764074)
Is that actually true, though (especially w.r.t. Forward Secrecy)? Don't both parties generate separate halves of a symmetric key independently, preventing any one party from forcing the use of a particular key on a new session?
[ Parent | on HN ]