Re: Re: [RFC Discussion] Precise Session Management
| From: | Yasuo Ohgaki | Date: | Wed, 27 Jan 2016 02:04:46 +0000 |
| Subject: | Re: Re: [RFC Discussion] Precise Session Management | ||
| References: | 1 2 3 4 5 6 7 8 9 10 11 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-90961@lists.php.net to get a copy of this message | ||
Hi!
On Wed, Jan 27, 2016 at 11:02 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>
> There are 2 ways to keep/generate stolen session
>
> - Set undeletable cookie to browser
> - Get active session via exploit and access it before GC
>
> As I have already explained, getting active session ID is trivial with
> access to psychical device. e.g. Steal colleges' session ID while they
> are leaving desk. It's just a matter of displaying session ID cookie
> and take picture of it.
- Set undeletable cookie to browser
this is
- Set unchangable cookie to browser
to be precise.
--
Yasuo Ohgaki
yohgaki@ohgaki.net