Last week's cookie-vuln won't be the last, security bod says
In the wake of last week's cookie security warning, accomplished Polish penetration tester Dawid Czagan has dug up a separate issue with Apple's Safari.
The bug Czagan has reported to Apple relates to its handling of the HTTPOnly flag, again leaving cookies open to attack.
Internet Explorer too suffers from cookie domain attribute insecurities, he says, and he has reiterated last week's warning that all major browsers need to guard against cookie hijacks. Speaking to Vulture South over the weekend, Czagan (@dawidczagan) said cookies are still an overlooked attack vector, and that when chained, they can result in more powerful attacks even if two factor authentication is used.
