-
January 16"You'll see the typical security geek saying, 'People are dumb, people are stupid, they're never going to be trained,'." said Rohyt Belani, PhishMe co-founder and CEO. "We have statistics to prove otherwise."
 |
|
Home /
What is PhishMe /
Blog /
Who We Are /
News & Events /
Contact Us /
Sign Up /
Site Map
Company |
Stay in Touch |
|
|---|---|---|
©2012 PhishMe, Inc.
Great find Corey! Maybe it's not too late for this to be reconsidered.
[...] OWASP conference proved to be a great ground to bring up this topic of the proposed Rails 2.0 cookie storage [...]
Please see my comment on Part II debunking the claim of brute-force attack.
Sorry, updated the link for “cookie_store.rb” which did take you to an older version of the file. Brute forcing the HMAC is still possible. I'm sure there are cases where this type of session storage would make sense, but from a security stand point, it makes me nervous that this will be the default storage option.