Re: Growing Bad Practice with Login Forms

["Darragh O'Brien" <dobrien () computing dcu ie>]

I have come across this same issue with a number of
websites. Do existing website vulnerabiltiy scanners
check for such problems?

Thanks,
Darragh

On Tuesday 27 July 2004 15:28, Konstantin Ryabitsev wrote:
> On Tue, 2004-07-27 at 10:20 -0400, Stan Guzik wrote:
> > Once you enter the site they set their cookie without SSL.  This is not
> > a good practice because it leaves the cookie (maybe session management)
> > open to a sniffing attack.
>
> This is indeed a valid concern, but a separate issue. If you got a
> session cookie over cleartext, then authenticated over SSL, your session
> can be compromised if the same session is used to identify you past-
> login.
>
> Regards,