RE: [PHP-GENERAL] Cookies/Remember password

not only can cookies be copied, to my horror i found out they can also be changed... Sites that use cookies for identity and use some running auto increment ID to know who the user is instead of a long token are vulnerable... berber -----Original Message----- From: Chris Sano [mailto:sano@mail.rit.edu] Sent: Wednesday, June 21, 2000 7:55 AM To: Masood Nasir; Andy Warwick Cc: Ayman Mackouly; php-general@lists.php.net Subject: RE: [PHP-GENERAL] Cookies/Remeber password The cookie can be copied. The exact cookie line just needs to be copied and pasted in the approprimate file. Chris -----Original Message----- From: Masood Nasir [mailto:masood@one.net.pk] Sent: Wednesday, June 21, 2000 11:50 AM To: Andy Warwick Cc: Ayman Mackouly; php-general@lists.php.net Subject: Re: [PHP-GENERAL] Cookies/Remeber password i doubt if the following (3) is possible. IMHO cookies can't be copied from one machine to another. i might be wrong? -- Regards, -- Masood Nasir :-) [Systems Engineer] - http://www.masood.net ;) -- One Net, Lahore, Pakistan. <http://www.one.net.pk> On Tue, 20 Jun 2000, Andy Warwick wrote: > on 20/6/00 11:29 pm, Ayman Mackouly at aymack@netvision.net.il wrote: > > 3. If a user copies the cookie to another machine they can get in. -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net For additional commands, e-mail: php-general-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net For additional commands, e-mail: php-general-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net