[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Re: Cookies at XML Europe 2004 -- Call for Participation


crack tls
Rich Salz scripsit:

> I'm not sure what you mean by replay attack.  What packets (HTTP 
> requests) is the adversary replaying?  If the initial login form is 
> protected by SSL, than there's nothing to steal for future replay. (If 
> your adversary can crack SSL/TLS, it's safe to assume they're going to 
> go after bigger fish than you might be. :)

Fair enough.  I was actually thinking of a man-in-the-middle attack or
equivalent, where the first time you send the cookie in the clear, I capture
it and send my own content with the same cookie.  The server thinks I am you.
You are quite right that this has less long-term exposure than HTTP basic,
but HTTP digest is better than either (deployment difficulties aside).

I don't see why embedding a capability in the URL is un-RESTy, though.
Every resource has a stable URL still; it's just that publishing certain
URLs becomes a Bad Thing.

-- 
John Cowan          http://www.ccil.org/~cowan        jcowan@r...
To say that Bilbo's breath was taken away is no description at all.  There are
no words left to express his staggerment, since Men changed the language that
they learned of elves in the days when all the world was wonderful. --The Hobbit

PURCHASE STYLUS STUDIO ONLINE TODAY!

Purchasing Stylus Studio from our online shop is Easy, Secure and Value Priced!

Buy Stylus Studio Now

Download The World's Best XML IDE!

Accelerate XML development with our award-winning XML IDE - Download a free trial today!

Don't miss another message! Subscribe to this list today.
Email
First Name
Last Name
Company
Subscribe in XML format
RSS 2.0
Atom 0.3
 

Stylus Studio has published XML-DEV in RSS and ATOM formats, enabling users to easily subcribe to the list from their preferred news reader application.


Stylus Studio Sponsored Links are added links designed to provide related and additional information to the visitors of this website. they were not included by the author in the initial post. To view the content without the Sponsor Links please click here.

Site Map | Privacy Policy | Terms of Use | Trademarks
Free Stylus Studio XML Training:
W3C Member
Stylus Studio® and DataDirect XQuery ™are products from DataDirect Technologies, is a registered trademark of Progress Software Corporation, in the U.S. and other countries. © 2004-2013 All Rights Reserved.