Full Disclosure mailing list archives

Re: Wordpress Cookie Authentication Vulnerability

From: Valdis.Kletnieks () vt edu
Date: Tue, 20 Nov 2007 19:21:29 -0500

On Wed, 21 Nov 2007 07:51:30 +0800, Eduardo Tongson said:

I wonder why we don't see web applications use secure cookie recipes
like [1] and [2]. There are also existing secure password hashing
frameworks such as Solar's [3]. Are developers just unaware of these
secure schemes?.


Browse the worsethanfailure.com website for a while, and you'll convince
yourself that the average developer thinks that booleans are trinary-state. ;)

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Current thread:

Wordpress Cookie Authentication Vulnerability Steven J. Murdoch (Nov 19)
- Re: Wordpress Cookie Authentication Vulnerability XSS Worm XSS Security Information Portal (Nov 20)
  - Re: Wordpress Cookie Authentication Vulnerability Steven Murdoch (Nov 20)
- Re: Wordpress Cookie Authentication Vulnerability Stefan Esser (Nov 20)
  - Re: Wordpress Cookie Authentication Vulnerability Steven J. Murdoch (Nov 20)
- <Possible follow-ups>
- Re: Wordpress Cookie Authentication Vulnerability Juha-Matti Laurio (Nov 20)
  - Re: Wordpress Cookie Authentication Vulnerability Steven Adair (Nov 20)
    - Re: Wordpress Cookie Authentication Vulnerability James Matthews (Nov 20)
    - Re: Wordpress Cookie Authentication Vulnerability Eduardo Tongson (Nov 20)
    - Re: Wordpress Cookie Authentication Vulnerability Valdis . Kletnieks (Nov 20)
    - Re: Wordpress Cookie Authentication Vulnerability Paul Schmehl (Nov 20)
    - Re: Wordpress Cookie Authentication Vulnerability Adrian P (Nov 21)
- Re: Wordpress Cookie Authentication Vulnerability Juha-Matti Laurio (Nov 22)