You are viewing a plain text version of this content. The canonical link for it is here.
Posted to modperl@perl.apache.org by Stas Bekman <sb...@stason.org> on 2000/05/11 23:37:07 UTC
talking about cookies (was: session something...)
For all those who favor chocolate cookies (mostly related to the latest
discussion about the sessions):
IE hole exposes Web surfers' private data: Microsoft is working on a
patch that will prevent its Internet Explorer browser from inadvertently
letting Web sites peer into any visitor's cookie files.
http://2.digital.cnet.com/cgi-bin2/flo?x=dAEoBmhggowKmYuum
http://slashdot.org/articles/00/05/11/173257.shtml
Now, think how many users will go use another similar service if yours
will force using cookies. No kidding, press (and the reality) teaches
people what to do and what not. It will take a while before the cookies
will be turned on by these frightened IE users, but I'm sure long time
before there will be another bug announced, so people will stop using them
at all. I can see a scenario where the "user-friendly" M$ will start
shipping IE preconfigured with cookies turned off.
M$ doesn't only prevent technologies from emerging, it also renders the
existing ones useless. This sucks!
______________________________________________________________________
Stas Bekman | JAm_pH -- Just Another mod_perl Hacker
http://stason.org/ | mod_perl Guide http://perl.apache.org/guide
mailto:stas@stason.org | http://perl.org http://stason.org/TULARC/
http://singlesheaven.com| http://perlmonth.com http://sourcegarden.org
----------------------------------------------------------------------
Re: talking about cookies (was: session something...)
Posted by Gunther Birznieks <gu...@extropia.com>.
At 07:28 PM 5/12/00 +0300, Stas Bekman wrote:
>On Fri, 12 May 2000, Keith G. Murphy wrote:
>
> > "Jeffrey W. Baker" wrote:
> > >
> > > On Thu, 11 May 2000, Marc Slemko wrote:
> > >
> > > > In reality, IE's recently publicized hole (which I reported to
> them, in a
> > > > slightly modified form, months ago but they didn't see fit to release a
> > > > patch...) doesn't change much.
> > > >
> > > > Hotmail? Yahoo mail? amazon.com? etc. Your cookies for all
> those sites
> > > > are vulnerable anyway due to the "cross site scripting" issue. This
> > > > particular hole in IE doesn't change things too much. Sure, there
> may be
> > > > the rare site that isn't vulnerable to cross site scripting. But
> that is
> > > > the very rare site, and most sites that think they aren't
> vulnerable are.
> > > >
> > > > Cookies are not secure and will never be secure. I have said it before
> > > > and will say it again many times before I die. Unfortunately, it
> isn't as
> > > > simple as saying "well, don't use cookies". There isn't much in
> the way
> > > > of alternatives for a lot of things...
> > >
> > > Cross-site scripting attacks are hard for most people to wrap their minds
> > > around. There are a zillion sites that are vulnerable, mainly because
> > > they parrot back to the user whatever they submitted without doing any
> > > validation or HTML/URL escaping. Then there are browser bugs that don't
> > > treat excaped character properly. Sigh.
> > >
> > Whether we're talking about the IE bug, or cross-site scripting issues,
> > wouldn't the whole thing be solved by users turning *off* scripting and
> > leaving the cookies *on*? I.e., in what ways are cookies not safe if
> > scripting is turned off?
>
>You are absolutely right. The question is who is going to explain this to
>users, MS?
MS Marketing engine is very strong and people get shocked when they read
something like that, but expedience says that most poeple think "Well, it
probably wont happen to me".
For example... Just because IIS itself has a lot of holes doesn't mean that
some of the top financial institutions don't use it for the websites (do a
random probe of financial SSL sites with Netcraft's utility)...
In fact, they probably love the holes because they get publicity and the
people with money remember the brand but rarely remember the techie details
of the problem. "Well as long as it was fixed, we should be able to run IIS
now right?". :)
> > [snipped]
>
> > But it does seem like not even MS is saying "Don't accept cookies".
> > Though they're still pretty quiet on the latest IE hole.
>
>Heh, you probably have never didn't do support :) it's enough for them to
>see the two words: "cookies" and "evil" in the same sentence, you know how
>most of them will conceive it, you shouldn't think twice. I doubt they
>know what "scripting" is. Also remember the bad history cookies carry with
>them.
Although I am sure there are people who turn off cookies, I believe that
there are many more people who couldn't care less and will leave them on.
However, I do concede that forcing users to use cookies for an open
internet site is silly. And it is becoming a lot sillier for eCommerce as
technologies like PDAs become more prevalent for people doing quick
searches and the like on the Web (PDAs typically do not implement cookie
capabilities)
__________________________________________________
Gunther Birznieks (gunther.birznieks@extropia.com)
Extropia - The Web Technology Company
http://www.extropia.com/
Re: talking about cookies (was: session something...)
Posted by Mike Miller <mm...@crusoe.net>.
On Fri, 12 May 2000 11:15:02 -0500, Keith G. Murphy wrote:
>
>What great functionality is lost if users turn off their scripting?
>
>Of course, this may be an abstract question in terms of programming, if
>users *do* insist on enabling scripting.
>
Some applications (for better or worse) support the use of Javascript/VB script to do client side
processing/validations, which allow for example, data ranges to be checked without returning data back
to the server, insure that all form fields were filled in, etc. These would not work with scripting
disabled, unless I am missing something (quite possible, though <grin>)
Granted you could force (and should anyway, as you should never accept user input verbatim <grin>) all
such validation logic back at the server, but this gets into UI/look and feel issues as every data entry
screen would require a trip back to the server, and not give the user the illusion of "real-time"
validations, reformatting, etc., that they have come to expect using windows/mac/X applications.
I might be veering off-topic into a general web based design philosophy discussion, so forgive me if
this is the case ... but it answered the question of the types of things that might be lost.
Brgds,
Mike.
Re: talking about cookies (was: session something...)
Posted by Stas Bekman <sb...@stason.org>.
On Fri, 12 May 2000, Keith G. Murphy wrote:
> "Jeffrey W. Baker" wrote:
> >
> > On Thu, 11 May 2000, Marc Slemko wrote:
> >
> > > In reality, IE's recently publicized hole (which I reported to them, in a
> > > slightly modified form, months ago but they didn't see fit to release a
> > > patch...) doesn't change much.
> > >
> > > Hotmail? Yahoo mail? amazon.com? etc. Your cookies for all those sites
> > > are vulnerable anyway due to the "cross site scripting" issue. This
> > > particular hole in IE doesn't change things too much. Sure, there may be
> > > the rare site that isn't vulnerable to cross site scripting. But that is
> > > the very rare site, and most sites that think they aren't vulnerable are.
> > >
> > > Cookies are not secure and will never be secure. I have said it before
> > > and will say it again many times before I die. Unfortunately, it isn't as
> > > simple as saying "well, don't use cookies". There isn't much in the way
> > > of alternatives for a lot of things...
> >
> > Cross-site scripting attacks are hard for most people to wrap their minds
> > around. There are a zillion sites that are vulnerable, mainly because
> > they parrot back to the user whatever they submitted without doing any
> > validation or HTML/URL escaping. Then there are browser bugs that don't
> > treat excaped character properly. Sigh.
> >
> Whether we're talking about the IE bug, or cross-site scripting issues,
> wouldn't the whole thing be solved by users turning *off* scripting and
> leaving the cookies *on*? I.e., in what ways are cookies not safe if
> scripting is turned off?
You are absolutely right. The question is who is going to explain this to
users, MS?
> [snipped]
> But it does seem like not even MS is saying "Don't accept cookies".
> Though they're still pretty quiet on the latest IE hole.
Heh, you probably have never didn't do support :) it's enough for them to
see the two words: "cookies" and "evil" in the same sentence, you know how
most of them will conceive it, you shouldn't think twice. I doubt they
know what "scripting" is. Also remember the bad history cookies carry with
them.
______________________________________________________________________
Stas Bekman | JAm_pH -- Just Another mod_perl Hacker
http://stason.org/ | mod_perl Guide http://perl.apache.org/guide
mailto:stas@stason.org | http://perl.org http://stason.org/TULARC/
http://singlesheaven.com| http://perlmonth.com http://sourcegarden.org
----------------------------------------------------------------------
Re: talking about cookies (was: session something...)
Posted by Stas Bekman <sb...@stason.org>.
On Fri, 12 May 2000, Jay Jacobs wrote:
> The issue isn't the technical aspects of the bug, or even the fact that
> users don't have to turn off cookies to fix the bug... the issue is that
> this, with help from the talented press, will cause more people to simply
> disable cookies whether right or wrong.
I second that.
> This ties back into a previous discussion about storing sessions (or
> session_id) in a cookie and how reliable (or unreliable) that is.
I think a hybrid of cookie/URI_embedding is the only way to go. If a user
supports cookie, shoot it out, if not rewrite URIs. I know it sucks but
JavaScript and HTML designers are always developing a different version of
their work for each platform...
> Jay Jacobs
> LachNet Inc.
>
>
> On Fri, 12 May 2000, Keith G. Murphy wrote:
>
> > "Jeffrey W. Baker" wrote:
> > >
> > > On Thu, 11 May 2000, Marc Slemko wrote:
> > >
> > > > In reality, IE's recently publicized hole (which I reported to them, in a
> > > > slightly modified form, months ago but they didn't see fit to release a
> > > > patch...) doesn't change much.
> > > >
> > > > Hotmail? Yahoo mail? amazon.com? etc. Your cookies for all those sites
> > > > are vulnerable anyway due to the "cross site scripting" issue. This
> > > > particular hole in IE doesn't change things too much. Sure, there may be
> > > > the rare site that isn't vulnerable to cross site scripting. But that is
> > > > the very rare site, and most sites that think they aren't vulnerable are.
> > > >
> > > > Cookies are not secure and will never be secure. I have said it before
> > > > and will say it again many times before I die. Unfortunately, it isn't as
> > > > simple as saying "well, don't use cookies". There isn't much in the way
> > > > of alternatives for a lot of things...
> > >
> > > Cross-site scripting attacks are hard for most people to wrap their minds
> > > around. There are a zillion sites that are vulnerable, mainly because
> > > they parrot back to the user whatever they submitted without doing any
> > > validation or HTML/URL escaping. Then there are browser bugs that don't
> > > treat excaped character properly. Sigh.
> > >
> > Whether we're talking about the IE bug, or cross-site scripting issues,
> > wouldn't the whole thing be solved by users turning *off* scripting and
> > leaving the cookies *on*? I.e., in what ways are cookies not safe if
> > scripting is turned off?
> >
> > What great functionality is lost if users turn off their scripting?
> >
> > Of course, this may be an abstract question in terms of programming, if
> > users *do* insist on enabling scripting.
> >
> > I do notice that both Microsoft and CERT, in their different ways,
> > recommend that folks turn off scripting for best protection against
> > cross-site scripting attacks:
> >
> > http://www.cert.org/advisories/CA-2000-02.html
> > http://www.microsoft.com/technet/security/crsstQS.asp
> >
> > So maybe some will get the message.
> > Though making ridiculous recommendations like avoiding "promiscuous
> > browsing" (CERT's words) doesn't help.
> > And MS's recommendation simply eliminates E-mail-based attacks using
> > their product (Outlook), while leaving others exposed. They make it
> > ridiculously hard to turn off scripting, then show you how to do it only
> > in a limited way.
> >
> > But it does seem like not even MS is saying "Don't accept cookies".
> > Though they're still pretty quiet on the latest IE hole.
> >
>
>
______________________________________________________________________
Stas Bekman | JAm_pH -- Just Another mod_perl Hacker
http://stason.org/ | mod_perl Guide http://perl.apache.org/guide
mailto:stas@stason.org | http://perl.org http://stason.org/TULARC/
http://singlesheaven.com| http://perlmonth.com http://sourcegarden.org
----------------------------------------------------------------------
Re: talking about cookies (was: session something...)
Posted by Jay Jacobs <ja...@lach.net>.
The issue isn't the technical aspects of the bug, or even the fact that
users don't have to turn off cookies to fix the bug... the issue is that
this, with help from the talented press, will cause more people to simply
disable cookies whether right or wrong.
This ties back into a previous discussion about storing sessions (or
session_id) in a cookie and how reliable (or unreliable) that is.
Jay Jacobs
LachNet Inc.
On Fri, 12 May 2000, Keith G. Murphy wrote:
> "Jeffrey W. Baker" wrote:
> >
> > On Thu, 11 May 2000, Marc Slemko wrote:
> >
> > > In reality, IE's recently publicized hole (which I reported to them, in a
> > > slightly modified form, months ago but they didn't see fit to release a
> > > patch...) doesn't change much.
> > >
> > > Hotmail? Yahoo mail? amazon.com? etc. Your cookies for all those sites
> > > are vulnerable anyway due to the "cross site scripting" issue. This
> > > particular hole in IE doesn't change things too much. Sure, there may be
> > > the rare site that isn't vulnerable to cross site scripting. But that is
> > > the very rare site, and most sites that think they aren't vulnerable are.
> > >
> > > Cookies are not secure and will never be secure. I have said it before
> > > and will say it again many times before I die. Unfortunately, it isn't as
> > > simple as saying "well, don't use cookies". There isn't much in the way
> > > of alternatives for a lot of things...
> >
> > Cross-site scripting attacks are hard for most people to wrap their minds
> > around. There are a zillion sites that are vulnerable, mainly because
> > they parrot back to the user whatever they submitted without doing any
> > validation or HTML/URL escaping. Then there are browser bugs that don't
> > treat excaped character properly. Sigh.
> >
> Whether we're talking about the IE bug, or cross-site scripting issues,
> wouldn't the whole thing be solved by users turning *off* scripting and
> leaving the cookies *on*? I.e., in what ways are cookies not safe if
> scripting is turned off?
>
> What great functionality is lost if users turn off their scripting?
>
> Of course, this may be an abstract question in terms of programming, if
> users *do* insist on enabling scripting.
>
> I do notice that both Microsoft and CERT, in their different ways,
> recommend that folks turn off scripting for best protection against
> cross-site scripting attacks:
>
> http://www.cert.org/advisories/CA-2000-02.html
> http://www.microsoft.com/technet/security/crsstQS.asp
>
> So maybe some will get the message.
> Though making ridiculous recommendations like avoiding "promiscuous
> browsing" (CERT's words) doesn't help.
> And MS's recommendation simply eliminates E-mail-based attacks using
> their product (Outlook), while leaving others exposed. They make it
> ridiculously hard to turn off scripting, then show you how to do it only
> in a limited way.
>
> But it does seem like not even MS is saying "Don't accept cookies".
> Though they're still pretty quiet on the latest IE hole.
>
Re: talking about cookies (was: session something...)
Posted by "Keith G. Murphy" <ke...@mindspring.com>.
"Jeffrey W. Baker" wrote:
>
> On Thu, 11 May 2000, Marc Slemko wrote:
>
> > In reality, IE's recently publicized hole (which I reported to them, in a
> > slightly modified form, months ago but they didn't see fit to release a
> > patch...) doesn't change much.
> >
> > Hotmail? Yahoo mail? amazon.com? etc. Your cookies for all those sites
> > are vulnerable anyway due to the "cross site scripting" issue. This
> > particular hole in IE doesn't change things too much. Sure, there may be
> > the rare site that isn't vulnerable to cross site scripting. But that is
> > the very rare site, and most sites that think they aren't vulnerable are.
> >
> > Cookies are not secure and will never be secure. I have said it before
> > and will say it again many times before I die. Unfortunately, it isn't as
> > simple as saying "well, don't use cookies". There isn't much in the way
> > of alternatives for a lot of things...
>
> Cross-site scripting attacks are hard for most people to wrap their minds
> around. There are a zillion sites that are vulnerable, mainly because
> they parrot back to the user whatever they submitted without doing any
> validation or HTML/URL escaping. Then there are browser bugs that don't
> treat excaped character properly. Sigh.
>
Whether we're talking about the IE bug, or cross-site scripting issues,
wouldn't the whole thing be solved by users turning *off* scripting and
leaving the cookies *on*? I.e., in what ways are cookies not safe if
scripting is turned off?
What great functionality is lost if users turn off their scripting?
Of course, this may be an abstract question in terms of programming, if
users *do* insist on enabling scripting.
I do notice that both Microsoft and CERT, in their different ways,
recommend that folks turn off scripting for best protection against
cross-site scripting attacks:
http://www.cert.org/advisories/CA-2000-02.html
http://www.microsoft.com/technet/security/crsstQS.asp
So maybe some will get the message.
Though making ridiculous recommendations like avoiding "promiscuous
browsing" (CERT's words) doesn't help.
And MS's recommendation simply eliminates E-mail-based attacks using
their product (Outlook), while leaving others exposed. They make it
ridiculously hard to turn off scripting, then show you how to do it only
in a limited way.
But it does seem like not even MS is saying "Don't accept cookies".
Though they're still pretty quiet on the latest IE hole.
Re: talking about cookies (was: session something...)
Posted by "Jeffrey W. Baker" <jw...@acm.org>.
On Thu, 11 May 2000, Marc Slemko wrote:
> In reality, IE's recently publicized hole (which I reported to them, in a
> slightly modified form, months ago but they didn't see fit to release a
> patch...) doesn't change much.
>
> Hotmail? Yahoo mail? amazon.com? etc. Your cookies for all those sites
> are vulnerable anyway due to the "cross site scripting" issue. This
> particular hole in IE doesn't change things too much. Sure, there may be
> the rare site that isn't vulnerable to cross site scripting. But that is
> the very rare site, and most sites that think they aren't vulnerable are.
>
> Cookies are not secure and will never be secure. I have said it before
> and will say it again many times before I die. Unfortunately, it isn't as
> simple as saying "well, don't use cookies". There isn't much in the way
> of alternatives for a lot of things...
Cross-site scripting attacks are hard for most people to wrap their minds
around. There are a zillion sites that are vulnerable, mainly because
they parrot back to the user whatever they submitted without doing any
validation or HTML/URL escaping. Then there are browser bugs that don't
treat excaped character properly. Sigh.
Mayhaps will we have a cross-site scripting bof at oracon?
-jwb
Re: talking about cookies (was: session something...)
Posted by Marc Slemko <ma...@znep.com>.
On Fri, 12 May 2000, Stas Bekman wrote:
>
> For all those who favor chocolate cookies (mostly related to the latest
> discussion about the sessions):
>
> IE hole exposes Web surfers' private data: Microsoft is working on a
> patch that will prevent its Internet Explorer browser from inadvertently
> letting Web sites peer into any visitor's cookie files.
> http://2.digital.cnet.com/cgi-bin2/flo?x=dAEoBmhggowKmYuum
> http://slashdot.org/articles/00/05/11/173257.shtml
>
> Now, think how many users will go use another similar service if yours
> will force using cookies. No kidding, press (and the reality) teaches
> people what to do and what not. It will take a while before the cookies
> will be turned on by these frightened IE users, but I'm sure long time
> before there will be another bug announced, so people will stop using them
> at all. I can see a scenario where the "user-friendly" M$ will start
> shipping IE preconfigured with cookies turned off.
>
> M$ doesn't only prevent technologies from emerging, it also renders the
> existing ones useless. This sucks!
In reality, IE's recently publicized hole (which I reported to them, in a
slightly modified form, months ago but they didn't see fit to release a
patch...) doesn't change much.
Hotmail? Yahoo mail? amazon.com? etc. Your cookies for all those sites
are vulnerable anyway due to the "cross site scripting" issue. This
particular hole in IE doesn't change things too much. Sure, there may be
the rare site that isn't vulnerable to cross site scripting. But that is
the very rare site, and most sites that think they aren't vulnerable are.
Cookies are not secure and will never be secure. I have said it before
and will say it again many times before I die. Unfortunately, it isn't as
simple as saying "well, don't use cookies". There isn't much in the way
of alternatives for a lot of things...