Re: Session Fixation

> Actually, I think suggesting to anyone that they invest in half-measures
the
> one hand, I can see your argument: it raises the bar ever so slightly,
They
> understand IP, they understand networking, but they don't really think
the
> un-informed bad choices and telling them to get it right is a receipe for

One should never rely on IP for *anything* :-)

I agree, except to say that I wouldn't consider it "investing in half measures" - at least, not the way I've coded it - since (a) it's one small measure among many other precautions taken (tamper-proof cookies, detection of scripted attacks, input validation, account lockouts, and so on) and (b), at ~5 lines of code, it's not much of an investment!

I very much agree that it should be made known to as many people as possible that IP, in the context of web services, is unreliable as a means of identification, as silly as that may sound to the uninitiated, and that it should never be depended on for anything - least of all security.

HarryM Received on Mon Mar 31 18:54:21 2003