Skip to content

Comment on 'Padding Oracle' Crypto Attack Affects Millions of ASP.NET Apps

Comments

This looks pretty bad. The standard way to authenticate in an asp.net app, FormsAuthentication.RedirectFromLoginPage(), basically encrypts a username and saves it to a cookie.

Any subsequent requests to a site will trust that cookie as long as it decrypts properly.

Yes, exactly. Among other things, this attack allows you to forge authentication cookies on any ASP.NET application with a 100% success rate.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.