[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

RE: Re: Cookies at XML Europe 2004 -- Call for Participation

• To: "'Joshua Allen'" <joshuaa@m...>, "'Rich Salz'" <rsalz@d...>, "'Elliotte Rusty Harold'" <elharo@m...>
• Subject: RE: Re: Cookies at XML Europe 2004 -- Call for Participation
• From: "Bob Wyman" <bob@w...>
• Date: Mon, 5 Jan 2004 18:48:52 -0500
• Cc: "'Edd Dumbill'" <edd@u...>, "'David Kunkel'" <DKunkel@i...>, "'XML-DEV'" <xml-dev@l...>
• Importance: Normal
• In-reply-to: <0E36FD96D96FCA4AA8E8F2D199320E52A549A6@R...>
• Reply-to: <bob@w...>

Joshua Allen of Microsoft wrote:
> Your privacy argument is fairly bogus
	Thank you for your polite and civil comment...

	My message stated a fact. It is a fact that "One of the
original motivations for doing cookies was to remove 'state
information' from the URL." Whether or not you think this was a bogus
concern is irrelevant to the truth of the statement. I participated in
the discussions I mentioned back in 1994 and know what was discussed.
	In any case, it is *not* a "bogus" argument. The truth is that
there are no absolutely secure systems. The goal of security design is
to raise the bar to the point where it becomes difficult to compromise
a system. We do not have reasonable technology to make systems
completely impenetrable. When state information is in URL's, it gets
recorded in log files as referrer data and is easily accessible by
people with low skill levels. While it is possible to intercept TCP/IP
sessions and extract cookie information, it is much more difficult to
do so than simply reading a log file. Thus, while a cookie based
system is not impenetrable, it is likely to compromised by fewer
people than an URL based system. The degree of difference in the
security of the two methods is certainly of subject of debate --
however, it is not useful to debate whether a difference exists. Your
argument is bogus.

		bob wyman

• References:
  • RE: Re: Cookies at XML Europe 2004 -- Call for Participation
    • From: "Joshua Allen" <joshuaa@m...>

• Prev by Date: REST and the Web - was Re: Re: Cookies at XML Europe 2004 -- Call for Particip ation
• Next by Date: Re: Re: Cookies at XML Europe 2004 -- Call for Participation
• Previous by thread: RE: Re: Cookies at XML Europe 2004 -- Call for Participation
• Next by thread: RE: Formalism and complexity
• Index(es):
  • Date
  • Thread