RE: Growing Bad Practice with Login Forms

[Konstantin Ryabitsev <icon () phy duke edu>]

On Tue, 2004-07-27 at 10:20 -0400, Stan Guzik wrote:
> Once you enter the site they set their cookie without SSL.  This is not
> a good practice because it leaves the cookie (maybe session management)
> open to a sniffing attack.

This is indeed a valid concern, but a separate issue. If you got a
session cookie over cleartext, then authenticated over SSL, your session
can be compromised if the same session is used to identify you past-
login.

Regards,
-- 
Konstantin Ryabitsev
Duke University Physics

Attachment: signature.asc
Description: This is a digitally signed message part