HN Explorer

9 comments

[ 1.00 ms ] story [ 28.7 ms ] thread
kpcyrd
It seems this has all disadvantages of jwt-style sessions, plus a BREACH-style vulnerability in the crypto due to compression if `plain-text-cookie-value` contains data an attacker can taint.
tptacek
Yeah, I'm pretty confused by this being on the front page.
ryacko
Worse: “SCS doesn't address replay of old cookie values.”
chrismorgan
A better title:

RFC 6896 - SCS: KoanLogic's Secure Cookie Sessions for HTTP [2013]

jedisct1
A better better title: RFC 6896 - SCS: KoanLogic's Insecure Cookie Sessions for HTTP [2013]
kerng
This doesn't seem to protect from Pass the Cookie attacks.

Edit - it's a common red teaming tactic: https://wunderwuzzi23.github.io/blog/passthecookie.html

0xfffff
Correct, it doesn't. If you grab that cookie and then pass the cookie from somewhere else it will work.

Section 7.2.3 talks about cookie theft.

kerng
Yeah, as others have pointed out this RFC is from 2013 - so a bit dated.