Typing the Letters A-E-S Into Your Code (2009)

Re:Typing the Letters A-E-S Into Your Code (2009) by olalonde on Saturday January 10, 2015 @03:03AM (#8866280)

I know the cookie example was just an excuse to talk about cryptography but I found it strange that there was no mention of using a randomly generated session ID and a session store as most web frameworks do.

[ Parent | on HN ]

Re:Typing the Letters A-E-S Into Your Code (2009) by Kliment on Saturday January 10, 2015 @06:18AM (#8866565)

Plaintext SID? Couldn't you just replay that SID then? Or generate random SIDs and see what sticks?

[ Parent | on HN ]

Re:Typing the Letters A-E-S Into Your Code (2009) by seszett on Saturday January 10, 2015 @06:53AM (#8866625)

If your SIDs are large enough, it's no different from generating random encrypted cookies until one works, so not practical at all.

[ Parent | on HN ]

Re:Typing the Letters A-E-S Into Your Code (2009) by jameshart on Saturday January 10, 2015 @09:36AM (#8866817)

The SSO scenario deals precisely with how to pass authentication between two systems which do not have a shared backend datastore.

[ Parent | on HN ]

Re:Typing the Letters A-E-S Into Your Code (2009) by callesgg on Saturday January 10, 2015 @11:47AM (#8867096)

Well encrypting the data is not really needed. Singing the data is.

[ Parent | on HN ]