Re: Replay attacks with cookie session

S. Robert James
2007-03-22T21:13:54Z

On Mar 22, 3:21 pm, "Jeremy Evans" <jeremyeva...@gmail.com>
wrote:
> It''s possible mitigate the problem somewhat by having an
expiration
> time put into the session (which cannot be modified by an attacker due
> to the HMAC).  However, you still won''t be able to manually expire
> sessions (i.e. log out).

This will only help in cases where the attacker wants to steal
someone''s identity.  But there are other uses of a replay attack -
like the example I initially mentioned - where this won''t help at
all.  And even in the identity theft case - what''s to stop the
attacker from using the computer 5 minutes after I leave?

In general, I''d offer the amount of confusion on this thread as the
best evidence that the average developer shouldn''t have to deal with
these issues by default.