Re: [PHP] Re: Cookie Security?

2004-06-14 Thread franciccio
I would suggest (haven't tried to write code in details) to associate a random number in a variable each time you send a cookie (for new cookies anyway) and store the key (randomvariable<->cookie) ina database. You should be able to verify the user at next connection verifying the matching key. "

Re: [PHP] Re: Cookie Security?

2004-06-14 Thread Michal Migurski
> [snip} > > As well as much harder for AOL subscribers (whose IP's change per-request) > > to use the site. > [snip] > > WHAT?? Are you sure of this? AOL really breaks internet browsing this > much? Sorry, I can't believe this. If this was true, many things would > break. Not really -- HTTP is st

Re: [PHP] Re: Cookie Security?

2004-06-14 Thread Chris
Paul Fierro wrote: On 06/14/2004 1:02 PM, Justin Patrin <[EMAIL PROTECTED]> wrote: As well as much harder for AOL subscribers (whose IP's change per-request) to use the site. WHAT?? Are you sure of this? AOL really breaks internet browsing this much? Sorry, I can't believe this. If this w

Re: [PHP] Re: Cookie Security?

2004-06-14 Thread Chris
Marek Kilimajer wrote: Justin Patrin wrote --- napísal:: [snip} As well as much harder for AOL subscribers (whose IP's change per-request) to use the site. [snip] WHAT?? Are you sure of this? AOL really breaks internet browsing this much? Sorry, I can't believe this. If this was true, many thin

Re: [PHP] Re: Cookie Security?

2004-06-14 Thread Paul Fierro
On 06/14/2004 1:02 PM, Justin Patrin <[EMAIL PROTECTED]> wrote: >> As well as much harder for AOL subscribers (whose IP's change per-request) >> to use the site. > > WHAT?? Are you sure of this? AOL really breaks internet browsing this > much? Sorry, I can't believe this. If this was true, many t

Re: [PHP] Re: Cookie Security?

2004-06-14 Thread Marek Kilimajer
Justin Patrin wrote --- napísal:: [snip} As well as much harder for AOL subscribers (whose IP's change per-request) to use the site. [snip] WHAT?? Are you sure of this? AOL really breaks internet browsing this much? Sorry, I can't believe this. If this was true, many things would break. I know

Re: [PHP] Re: Cookie Security?

2004-06-14 Thread Justin Patrin
Robert Cummings wrote: On Mon, 2004-06-14 at 14:02, Justin Patrin wrote: [snip] As well as much harder for AOL subscribers (whose IP's change per-request) to use the site. [snip] I don't think it changes per request, but rather has the potential to change between requests. I still don't believe t

Re: [PHP] Re: Cookie Security?

2004-06-14 Thread Robert Cummings
On Mon, 2004-06-14 at 14:02, Justin Patrin wrote: > [snip} > > As well as much harder for AOL subscribers (whose IP's change per-request) > > to use the site. > [snip] > I don't think it changes per request, but rather has the potential to change between requests. Cheers, Rob. -- .

Re: [PHP] Re: Cookie Security?

2004-06-14 Thread Justin Patrin
[snip} As well as much harder for AOL subscribers (whose IP's change per-request) to use the site. [snip] WHAT?? Are you sure of this? AOL really breaks internet browsing this much? Sorry, I can't believe this. If this was true, many things would break. I know that dial-up users get different IP

Re: [PHP] Re: Cookie Security?

2004-06-14 Thread Michal Migurski
> > My login script sets unique, secure, cookies that identify the user. > > Some of my pages only display content if a secure cookie is present. > > Is this a bad idea for secure pages with sensitive details as I have > > heard that cookies can be faked? I am always interested in creating a > > se

[PHP] Re: Cookie Security?

2004-06-14 Thread Justin Patrin
Phpmail wrote: My login script sets unique, secure, cookies that identify the user. Some of my pages only display content if a secure cookie is present. Is this a bad idea for secure pages with sensitive details as I have heard that cookies can be faked? I am always interested in creating a secure

[PHP] RE: Cookie security

2003-06-03 Thread SLanger
[snip] Can I trust every browser to check for old cookies on startup and eliminate them? And still, even if I can, wouldn't the cookie be intact to read on the harddrive until the browser is started again? I was thinking about slicing the username and password strings in two, and storing the halv