[4687] in Privacy_Forum
[ PRIVACY Forum ] Unsafe cookies leave WordPress accounts open to
daemon@ATHENA.MIT.EDU (PRIVACY Forum mailing list)
Mon May 26 14:08:38 2014
Date: Mon, 26 May 2014 10:34:10 -0700
To: privacy-list@vortex.com
Message-ID: <20140526173410.GB8524@vortex.com>
MIME-Version: 1.0
Content-Disposition: inline
From: PRIVACY Forum mailing list <privacy@vortex.com>
Reply-To: PRIVACY Forum mailing list <privacy@vortex.com>
Content-Type: text/plain; charset="iso-8859-1"
Errors-To: privacy-bounces+privacy-forum=mit.edu@vortex.com
Content-Transfer-Encoding: 8bit
Unsafe cookies leave WordPress accounts open to hijacking, 2-factor bypass
(Ars Technica): http://arstechnica.com/security/2014/05/unsafe-cookies-leave-wordpress-accounts-open-to-hijacking-2-factor-bypass/
"Memo to anyone who logs in to a WordPress-hosted blog from a
public Wi-Fi connection or other unsecured network: It's trivial
for the script kiddie a few tables down to hijack your site even
if it's protected by two-factor authentication. Yan Zhu, a staff
technologist at the Electronic Frontier Foundation, came to that
determination after noticing that WordPress servers send a key
browser cookie in plain text, rather than encrypting it, as long
mandated by widely accepted security practices."
- - -
--Lauren--
Lauren Weinstein (lauren@vortex.com): http://www.vortex.com/lauren
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
_______________________________________________
privacy mailing list
http://lists.vortex.com/mailman/listinfo/privacy
