Full Disclosure mailing list archives
Re: Wordpress Cookie Authentication Vulnerability
From: Paul Schmehl <pauls () utdallas edu>
Date: Tue, 20 Nov 2007 18:47:35 -0600
--On November 20, 2007 7:21:29 PM -0500 Valdis.Kletnieks () vt edu wrote:
On Wed, 21 Nov 2007 07:51:30 +0800, Eduardo Tongson said:I wonder why we don't see web applications use secure cookie recipes like [1] and [2]. There are also existing secure password hashing frameworks such as Solar's [3]. Are developers just unaware of these secure schemes?.Browse the worsethanfailure.com website for a while, and you'll convince yourself that the average developer thinks that booleans are trinary-state. ;)
They're not???)(*&)(*&@)(*(*#)(*&$ :-D Paul Schmehl (pauls () utdallas edu) Senior Information Security Analyst The University of Texas at Dallas http://www.utdallas.edu/ir/security/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Wordpress Cookie Authentication Vulnerability Steven J. Murdoch (Nov 19)
- Re: Wordpress Cookie Authentication Vulnerability XSS Worm XSS Security Information Portal (Nov 20)
- Re: Wordpress Cookie Authentication Vulnerability Steven Murdoch (Nov 20)
- Re: Wordpress Cookie Authentication Vulnerability Stefan Esser (Nov 20)
- Re: Wordpress Cookie Authentication Vulnerability Steven J. Murdoch (Nov 20)
- <Possible follow-ups>
- Re: Wordpress Cookie Authentication Vulnerability Juha-Matti Laurio (Nov 20)
- Re: Wordpress Cookie Authentication Vulnerability Steven Adair (Nov 20)
- Re: Wordpress Cookie Authentication Vulnerability James Matthews (Nov 20)
- Re: Wordpress Cookie Authentication Vulnerability Eduardo Tongson (Nov 20)
- Re: Wordpress Cookie Authentication Vulnerability Valdis . Kletnieks (Nov 20)
- Re: Wordpress Cookie Authentication Vulnerability Paul Schmehl (Nov 20)
- Re: Wordpress Cookie Authentication Vulnerability Steven Adair (Nov 20)
- Re: Wordpress Cookie Authentication Vulnerability XSS Worm XSS Security Information Portal (Nov 20)
- Re: Wordpress Cookie Authentication Vulnerability Adrian P (Nov 21)