[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Re: Cookies at XML Europe 2004 -- Call for Participation

• To: Rich Salz <rsalz@d...>
• Subject: Re: Re: Cookies at XML Europe 2004 -- Call for Participation
• From: Alaric B Snell <alaric@a...>
• Date: Thu, 08 Jan 2004 12:01:03 +0000
• Cc: Elliotte Rusty Harold <elharo@m...>,"xml-dev@l..." <xml-dev@l...>
• In-reply-to: <Pine.LNX.4.44L0.0401071853240.11874-100000@s...>
• References: <Pine.LNX.4.44L0.0401071853240.11874-100000@s...>
• User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20030704 Debian/1.4-1

> The differences between a login session and basic-auth/digest style,
> is two-fold.  First, if stolen, the impersonation is good for a
> finite time, not until I notice and change my password.  The second,
> is that the adversary only has session credentials, and not my
> long-term login password.  Those are very significant differences.

Indeed, in particular because sites with varying levels of security such 
as Amazon will use a cookie to identify you so you can alter your 
personal details, see stuff customised, and so on, but when you go to 
actually order they ask you to enter your password again.

So somebody who steals the session by intercepting one request's cookie 
will not be able to order things, unlike somebody who stole an HTTP Auth 
request.

Also, many people reuse the same username/password on different sites, 
but the same cookie will only ever be valid on different sites by 
extreme unlikely chance :-)

ABS

• Follow-Ups:
  • Re: Re: Cookies at XML Europe 2004 -- Call forParticipation
    • From: Elliotte Rusty Harold <elharo@m...>

• References:
  • Re: Re: Cookies at XML Europe 2004 -- Call for Participation
    • From: Rich Salz <rsalz@d...>

• Prev by Date: Re: Re: Cookies at XML Europe 2004 -- Call for Participation
• Next by Date: anyone know of good places to get opengis data?
• Previous by thread: Re: Re: Cookies at XML Europe 2004 -- Call for Participation
• Next by thread: Re: Re: Cookies at XML Europe 2004 -- Call forParticipation
• Index(es):
  • Date
  • Thread