[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: Gmail/SSL

To: or-talk@xxxxxxxxxxxxx
Subject: Re: Gmail/SSL
From: coderman <coderman@xxxxxxxxx>
Date: Mon, 10 Mar 2008 17:47:14 -0800
Delivered-to: archiver@xxxxxxxx
Delivered-to: or-talk-outgoing@xxxxxxxx
Delivered-to: or-talk@xxxxxxxx
Delivery-date: Mon, 10 Mar 2008 21:47:19 -0400
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=bXAvokErN0NeBffk5TZSk47ZLl9moaw5HHV5ZEgfjtY=; b=fOEQSBuNY6mm7lvUi1bZdX6lNJB1WwrUPHt9IfgRIsgQX9dB2tWhBAIMUCl3VtzAwhofvV2Of5RbTA77RF7fxBuVqx5grlOtsZ6LqCVDA70Lpr5rkqWANfrUe6y4itmL9wW+5rxO6Hlaea4SfKIfm2dnnpQtXPYnKAVBljMHm54=
Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=l7WKe4QuiVApCZWwNOJmoK/6sD2X+0n8xu6jghmN4lEnfO0wApvuKYrCrpAluBCHnWgxysP1T/d4WzNx8V8ebUVEGFEjciseF7pzL2kF3Q0TZJr24XMgPXf05NZUx70Gc0E9+P2qn1savw2Al1jCcqTJLpa4bt9qmpWq+sq0/kQ=
In-reply-to: <4ef5fec60803101837o55cfcbb3w1f7df02e1b0f3322@xxxxxxxxxxxxxx>
References: <1da45f2a0803091723i563a98a3tf4aecb00fcbf20cc@xxxxxxxxxxxxxx> <a46699dc0803091805m2d8a1851l9edff27e994ba564@xxxxxxxxxxxxxx> <a45400c30803092237x6ab69804j89aedc22fdb20d3e@xxxxxxxxxxxxxx> <47D5103B.5000408@xxxxxxxxxxxxxxxxxx> <4ef5fec60803101837o55cfcbb3w1f7df02e1b0f3322@xxxxxxxxxxxxxx>
Reply-to: or-talk@xxxxxxxxxxxxx
Sender: owner-or-talk@xxxxxxxxxxxxx

On Mon, Mar 10, 2008 at 5:37 PM, coderman <coderman@xxxxxxxxx> wrote:
> ...
>  managing this on your end transparently makes it impossible to
>  exploit.

i am referring solely to the auth cookie management here; host and
browser vulnerabilities that bypass SSL/TLS protections are an
entirely different problem...

regarding the modification of cookie parameters via browser plugin,
"Modify Headers" [0] might be a close fit needing only a few tweaks to
implement secure only.

0. https://addons.mozilla.org/en-US/firefox/addon/967

Follow-Ups:
- Re: Gmail/SSL
  - From: coderman

References:
- Gmail/SSL
  - From: Jonathan Addington
- Re: Gmail/SSL
  - From: John Kimble
- Re: Gmail/SSL
  - From: defcon
- Re: Gmail/SSL
  - From: Mike Cardwell
- Re: Gmail/SSL
  - From: coderman

Prev by Author: Re: Gmail/SSL
Next by Author: Re: Gmail/SSL
Previous by thread: Re: Gmail/SSL
Next by thread: Re: Gmail/SSL
Index(es):
- Author
- Thread