Quote:
Originally Posted by isf
You're correct, they would need the IP. Here's a (rough untested example) of a much simpler version that does leak the ID (if you know how to decode it) but still renders it useless for fuzzing unless you can somehow do an IP takeover.
|
A webmaster could still swap uid's of two of his visitors by xor ing their cookies with the sha1 of each ip address.
Quote:
Originally Posted by isf
I'd think it'd be easier to match the webwise id to OIX ad server request log files.
|
Probably would be easier, but neither is difficult. The search space for the brute force attack is < 1e7. If you know the RAS a user is on it is even smaller.
---------- Post added at 14:56 ---------- Previous post was at 14:55 ----------
Quote:
Originally Posted by bluecar1
only problem with that is BT Retail use dynamic IP's
peter
|
Not the only problem but certainly is one.
