Re: Ecommerce site - how?

From	"J.O. Aho" <user@example.net>
Newsgroups	comp.lang.php
Subject	Re: Ecommerce site - how?
Date	2017-06-27 19:43 +0200
Message-ID	<erfjqtF14n4U1@mid.individual.net> (permalink)
References	(7 earlier) <oirinj$1t87$1@gioia.aioe.org> <erd5pbFhbolU1@mid.individual.net> <oirtfe$h7d$1@gioia.aioe.org> <ere866Fn9ftU1@mid.individual.net> <oitbte$jts$1@gioia.aioe.org>

Show all headers | View raw

On 06/27/17 11:24, R.Wieser wrote:
> J.O.
> 
>> No, it's not an issue with ISP, it's the e-commerce site which is the
> issue.
> 
> Ofcourse it is !   I guess when your bike has a flat tire you will complain
> to the brick-and-mortar store too ? /s

Depends on if the brick and mortar store has pored out glass shards on
the bike road or not.

>> So you mean that ISP should provide the worse possible customer
>> experience so that badly designed e-commerce sites would keep on
>> working?
> 
> One) Nope (who the heck said that ?   I'm rather sure I didn't).    But as
> you are amadant that problems (knowingly!) created by your ISP (and others)
> should be solved by whomever you want to connect to -- of which an
> e-commerse site is just one, as I've been trying to explain a few times
> now -- I don't think we have anything to discuss anymore.

So if IP-binding is so important protection, explain why non of the
major e-commerce, social media sites does it? Enlighten how you have
better knowledge than Amazon, eBay, ...

> Two) Its your ISP with its "lets change IPs whenever we like it"* who is the
> one who is be causing the "worst possible customer experience", no matter
> what site/server you connect to.   SSL connections will be dropped, logging
> in will be broken for the same reason.

I see you have no sense how things works, switching IP in the middle of
a session will not cause you any problems, unless you have someone
thinking IP-binding to session is the solution to everything.

Have you ever tried with a laptop, login into a site at home, then
hibernate it and go somewhere (maybe you have a friend you can visit)
and connect to the wifi, so your big surprise you will see that you are
still logged in. If you don't have a laptop, you can use your cell phone
first be on wifi and login, disable wifi and continue to surf.

>> Yes, it will be part of the same http post, but that don't mean it will
>> be automatically added to CSRF request.
> 
> The are part of the same http request, but not of the CSRF request ?   You
> have to explain that one to me I'm afraid.  And no, I'm not going to scour
> that site in search of what you might be thinking of.  Either you link to or
> quote it, or I'm going to consider this matter closed (don't want to waste
> more time at it as I've already done).

Cookies are automatically added to a request to a page which has a
cookie on your browser. Data that must be sent with a POST/GET/PUT do
not be added automatically to a request which a third party request
makes in your browser.

As the CSRF request will have your IP (as it's your browser executing
it), binding the session to the IP will not protect you.

>> Yes, if he finds current one, he will find the previous one too,
> 
> Nope.   And believe me, as thats my experience with searching the interwebs
> speaking there.  Sometimes you can, but more often you don't.

Stop using obscure search engines then.

-- 

 //Aho

Thread

Ecommerce site - how? bit-naughty@hotmail.com - 2017-06-25 05:42 -0700
  Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-25 15:30 +0200
    Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-25 16:03 +0200
    Re: Ecommerce site - how? gordonb.y152t@burditt.org (Gordon Burditt) - 2017-06-26 05:43 -0500
      Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-26 17:12 +0200
        Re: Ecommerce site - how? "Christoph M. Becker" <cmbecker69@arcor.de> - 2017-06-26 17:54 +0200
          Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-26 19:40 +0200
            Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-26 21:42 +0200
              Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-26 23:14 +0200
                Re: Ecommerce site - how? "Christoph M. Becker" <cmbecker69@arcor.de> - 2017-06-27 00:28 +0200
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 10:48 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-27 07:56 +0200
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 12:27 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-27 19:15 +0200
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 22:01 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-28 07:07 +0200
                Re: Ecommerce site - how? Gordon Burditt <gordon@hammy.burditt.org> - 2017-06-30 17:08 -0500
        Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-26 18:29 +0200
          Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-26 19:17 +0200
            Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-26 13:34 -0400
              Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-26 20:11 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-26 21:31 +0200
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-26 22:29 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-27 07:19 +0200
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 11:24 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-27 19:43 +0200
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 23:09 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-28 07:12 +0200
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-27 21:10 -0400
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-26 16:32 -0400
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 10:30 +0200
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-27 08:38 -0400
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 17:47 +0200
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-27 12:16 -0400
                Re: Ecommerce site - how? gordonb.bytf1@burditt.org (Gordon Burditt) - 2017-06-29 18:16 -0500
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-29 20:41 -0400
                Re: Ecommerce site - how? gordonb.99a3p@burditt.org (Gordon Burditt) - 2017-06-29 23:39 -0500
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-30 07:28 -0400
                Re: Ecommerce site - how? Stefan+Usenet@Froehlich.Priv.at (Stefan Froehlich) - 2017-06-30 13:48 +0000
                Re: Ecommerce site - how? gordonb.gcghn@burditt.org (Gordon Burditt) - 2017-06-30 16:15 -0500
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-30 22:35 -0400
                Re: Ecommerce site - how? Richard Damon <Richard@Damon-Family.org> - 2017-06-29 23:46 -0400
        Re: Ecommerce site - how? gordonb.d2wed@burditt.org (Gordon Burditt) - 2017-06-29 17:32 -0500
  Re: Ecommerce site - how? bit-naughty@hotmail.com - 2017-06-27 10:58 -0700
    Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-27 15:34 -0400
    Re: Ecommerce site - how? gordonb.4psc7@burditt.org (Gordon Burditt) - 2017-06-30 16:55 -0500
      Re: Ecommerce site - how? bit-naughty@hotmail.com - 2017-07-01 03:03 -0700
        Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-07-01 09:30 -0400
        Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-07-01 09:34 -0400

csiph-web