BSidesLV 2013 Cookie Reuse Sam Bowne

Video from BSidesLV 2013. All videos, with downloads, can be found at this link shortly:

[djnetik]

This is a failure in chase not invaliding the session cookie on the backend server.

It's Session Reuse, not cookie reuse. Still, not good.

However, it's not "really bad". Here's why: Chase uses H T T P_S. So an attacker has to mitm the H T T P_S session. The changing password problem is really bad though.

[tukkek]

Interesting, short and a surprise double talk, but too much noise.