Re: Stopping stolen / spoofed / linked sessions

Bill Rausch pressed the little lettered thingies in this order... > Rasmus, et.al., > > OK, I'm still confused. What does SSL have to do with any of this? > SSL makes it impossible (well, improbable anyway) to sniff the session ID from the network. Without SSL, anyone on the network between the origin (client) and the destination (server) can get the session ID in plain text by installing a packet sniffer on the network. If you're relying on the URL to send session IDs, you'll never conquer the "person looking over the shoulder" problem (assuming that you believe that it's reasonable that someone can look over another's shoulder and write down a 20 character string without the first person noticing). Christopher Ostmo a.k.a. tech@AppIdeas.com AppIdeas.com Meeting cutting edge dynamic web site needs For a good time, http://www.AppIdeas.com/