The Dangers of Improper Cookie Use

shifted89 writes "Over the last year, the security community have exposed web application security for what it is — extremely lacking. However, for all the focus on XSS, CSRF, history stealing, etc., not much attention has been given to the cookie. Unfortunately, cookie misuse can be just as dangerous, if not more so than XSS attacks and InformIT illustrates why. In short, the author clearly demonstrates what can happen when a website improperly uses cookies for customer tracking — including a working illustration."

Old News

[MyLongNickName]

Cookie misuse has been chronicled here [bbc.co.uk]

Cookies? Javascript? Etc?

[Anonymous Coward]

I disable them all because I hate any innovation of the web past 1991. Anyone who disagrees with me is wrong. This article is proof.

Re:Cookies? Javascript? Etc?

[Anonymous Coward]

Really? I'm the opposite.

As Scott McNealy once said, "Privacy is dead, deal with it". I've extended that to security which is why I enable javascript and install the binary-only flash player which is configured to auto execute bytecode from any server on the web. In my vision of the future, anybody with disabilities, privacy concerns, security concerns or who is running something other than Windows isn't worth bothering with. Viva innovation, especially from Microsoft!

Remember..

[Swimport]

Cookies go in the mouth not the nose.

The Real Danger of Improper Cookie Use

[MrCopilot]

The Real Danger of Improper Cookie Use:

Two Words: Crumby Milk

Thank You and Tip your Servers.

Obligatory Simpsons reference....

[Illusion2269]

Mindy: What's wrong?
Homer: Oh, yeah, like you don't know. We're gonna have sex!
Mindy: Oh...well, we don't have to.
Homer: Yes we do! The cookie told me so.
Mindy: Well...desserts aren't always right.
Homer: But they're so sweet!

Re:Cookies? Javascript? Etc?

[kalaf]

High resolution porn? No wait, I take it back!

Re:Old News

[Anonymous Coward]

So you've never imagined Yoda saying "Waka waka waka"

Re:Old News

[sharkey]

Such a tender, heartwarming account of someone bettering himself. What they don't show is the agonizing struggle he went through. [youtube.com]

Re:practical, perhaps?

[PCM2]

Sort of like trying to find a windows virus filter only to find that the virus filter has infected you.

Where the hell do you live? Soviet Russia?

You lie! FUD! FUD!

[fm6]

If you were really that old-fashioned, you wouldn't have to disable JavaScript. The graphical web browser was invented in 1992, so you'd be compelled to use a text-only browser, such as Lynx. And those don't have any JavaScript to disable.

You are obviously part of an Evil Conspiracy. Please rant some more so I can figure out which one.

Re:What about clipboard theft?

[geobeck]

From that site:

Did you know that by default Internet Explorer allows any website to obtain the current contents of your clipboard? This isn't a bug, Microsoft considers it a feature.

Damn Microsoft for removing features in IE7!

Re:Cookies? Javascript? Etc?

[MillionthMonkey]

Well maybe you weren't downloading porn in 1991 but some of us were already busy gluing uuencoded ladies back together.