W3C home > Mailing lists > Public > public-web-security@w3.org > March 2012

Re: Related Domain Cookie Attacks

From: Collin Jackson <collin.jackson@sv.cmu.edu>
Date: Mon, 12 Mar 2012 07:46:06 -0700
Message-ID: <CANVv-Vd78MR7B=TKJVM5eBctntT7VLPsit1kSobCdWPVuZZ-tg@mail.gmail.com>
To: Enduro USA Tour <endurousatour@yahoo.com>
Cc: "public-web-security@w3.org" <public-web-security@w3.org>, Andrew Bortz <abortz@cs.stanford.edu>
This paper has some proposals:
http://www.w2spconf.com/2011/papers/session-integrity.pdf

On Sun, Mar 11, 2012 at 8:53 AM, Enduro USA Tour <endurousatour@yahoo.com>wrote:

>
>
> I'm an independent security researcher and am interested in addressing
> Related Domain Cookie Attacks.  See these links for more info on the
> problem:
> http://security.stackexchange.com/q/12412/396  andhttp://stackoverflow.com/q/9636857/328397
>
> I would like to pitch a few approaches on addressing this vulnerability,
> but before I do that, is anyone aware of a solution that binds a cookie to
> a host, limiting the ability of the attacker to transfer or replay it on a
> different host?  That is essentially the vulnerability that is described in
> the links above.
>
> Before I pitch my solution, I'd like to see if you agree that the issue is
> relevant to this group, and of importance.
>
> Thanks for your time!
>
> Chris Lamont Mankowski
>
>
>
>
Received on Monday, 12 March 2012 14:47:21 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Monday, 12 March 2012 14:47:21 GMT