Re: Related Domain Cookie Attacks

This paper has some proposals:
http://www.w2spconf.com/2011/papers/session-integrity.pdf

On Sun, Mar 11, 2012 at 8:53 AM, Enduro USA Tour <endurousatour@yahoo.com>wrote:

>
>
> I'm an independent security researcher and am interested in addressing
> Related Domain Cookie Attacks.  See these links for more info on the
> problem:
> http://security.stackexchange.com/q/12412/396  andhttp://stackoverflow.com/q/9636857/328397
>
> I would like to pitch a few approaches on addressing this vulnerability,
> but before I do that, is anyone aware of a solution that binds a cookie to
> a host, limiting the ability of the attacker to transfer or replay it on a
> different host?  That is essentially the vulnerability that is described in
> the links above.
>
> Before I pitch my solution, I'd like to see if you agree that the issue is
> relevant to this group, and of importance.
>
> Thanks for your time!
>
> Chris Lamont Mankowski
>
>
>
>