[Zope-dev] Re: [patch] More secure cookie crumbler?

[Shane Hathaway]

On Tue, 20 Apr 2004, Chris Withers wrote:

> I wonder how many Plone users are aware their passwords are stored
> unencrypted in client cookies which fly back and forth waiting to be
> snapped up by packet sniffers, XSS, and JS attacks ;-)

Even with unbreakable encryption of credentials after login, you still
send the username and password in the clear at login time, and sniffers
can reuse the session ID with ease.  You really shouldn't tell the Plone
users they will be safer with a session token, because they won't.

Shane