Re: AW: JRun: The Easiness of Session Fixation

From: Hannes Schmiderer <securityfocus.com_n(at)schmiderer.cc>
Date: Sat Mar 01 2003 - 20:07:37 EST

('binary' encoding is not supported, stored as-is)
In-Reply-To: <BC075A4ACA1BE640BF9D9A80BEA93AC0021F9A@wsv01.d-con.com>

>I save the incoming ip address when the session is created. On each =

Hi,
This does not help always: If users are using the same proxy or are in the same private network the have all the same IP address.

On the other hand, there are providers who do not only give new IP addresses per internet connection, but also per HTTP access. So they may have different IP addresses on consecutive page hits.

For instance AOL is such a provider:
http://webmaster.info.aol.com/proxyinfo.html Received on Sat Mar 1 20:56:13 2003