Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #17507

Re: Ecommerce site - how?

Show all headers | View raw

J.O.

> Depends on if the brick and mortar store has pored out glass
> shards on the bike road or not.

Oh, such a *good* comparision.  Yes, its the e-commerce site who makes your
ISP change the IP all the time, and who has instructed your company to
install two modems and alternate connections on them ofcourse.  /s

> So if IP-binding is so important protection, explain why non of the
> major e-commerce, social media sites does it?

Lol.   I don't believe at all you are in any way privy to how those sites
handle their connections, though you sure want to make me believe you do.
Sorry, didn't work.

Though thru a change that has been happening on the web the last year or so
the IP check by comparing them with one stored into a PHP session has become
rather moot.  Can you guess which change ?

And if you can, can you explain *how* it has become moot ?

> Have you ever tried with a laptop, login into a site at home, then
> hibernate it and go somewhere (maybe you have a friend you can
> visit) and connect to the wifi, so your big surprise you will see that
> you are still logged in.

Logged in to *what* exactly ?   Some social site (which does not actually
care that much who's on the connection), or on an e-commerce site (better
yet, a bank).  I higly doubt it that any of the latter two will allow you to
do that (if they would they would be, as far as I'm concerned, criminaly
stupid).

> you can use your cell phone first be on wifi and login, disable
> wifi and continue to surf.

:-) To you "it just works", doesn't it ?   You have absolutily no idea *how*
it does, but that doesn't stop you in the slightest in regard to trying to
use it as proof.

Look up handing off connections, and how it works.  And yes, that does need
the cooperation of either your ISP/phone company (assuming both
communication channels converge there), or the website you're connecting to.

> Cookies are automatically added to a request to a page which has
> a cookie on your browser.

True.

> Data that must be sent with a POST/GET/PUT do not be added
> automatically to a request which a third party request makes in
> your browser.

Care to rephrase that ?  Its rather unreadable to me.  It reads as some
legaleese mumbo-jumbo.  The words are there, just the sentence does not make
any sense. "data ... do not be added automatically to a request" ?   "a
request which a third party request makes" ?

As for "not be added automatically", what do you think is the chance that it
can be added "manually" ?  :-)

> As the CSRF request will have your IP (as it's your browser
> executing it), binding the session to the IP will not protect you.

Nope, and neither will any of the others method you can come up with, as a
well-written piece of malware will just change the data on the webpage
itself, just before the request gets actually send to the remote site*.
Your point is ?

*and yes, several strains of banking malware has been known to do exactly
that.

And no, we where, or at least I was, not talking about attacks from inside
the users computer.  If it has come that far than he's screwed anyway, one
way or the other.

> Stop using obscure search engines then.

You already said that.  Repeating it like this is either a sign of a feeble
mind, or of not really having anything to say to the reply you got the first
time you said it. What is it ?

Regards,
Rudy Wieser


-- Origional message:
J.O. Aho <user@example.net> schreef in berichtnieuws
erfjqtF14n4U1@mid.individual.net...
> On 06/27/17 11:24, R.Wieser wrote:
> > J.O.
> >
> >> No, it's not an issue with ISP, it's the e-commerce site which is the
> > issue.
> >
> > Ofcourse it is !   I guess when your bike has a flat tire you will
complain
> > to the brick-and-mortar store too ? /s
>
> Depends on if the brick and mortar store has pored out glass shards on
> the bike road or not.
>
> >> So you mean that ISP should provide the worse possible customer
> >> experience so that badly designed e-commerce sites would keep on
> >> working?
> >
> > One) Nope (who the heck said that ?   I'm rather sure I didn't).    But
as
> > you are amadant that problems (knowingly!) created by your ISP (and
others)
> > should be solved by whomever you want to connect to -- of which an
> > e-commerse site is just one, as I've been trying to explain a few times
> > now -- I don't think we have anything to discuss anymore.
>
> So if IP-binding is so important protection, explain why non of the
> major e-commerce, social media sites does it? Enlighten how you have
> better knowledge than Amazon, eBay, ...
>
> > Two) Its your ISP with its "lets change IPs whenever we like it"* who is
the
> > one who is be causing the "worst possible customer experience", no
matter
> > what site/server you connect to.   SSL connections will be dropped,
logging
> > in will be broken for the same reason.
>
> I see you have no sense how things works, switching IP in the middle of
> a session will not cause you any problems, unless you have someone
> thinking IP-binding to session is the solution to everything.
>
> Have you ever tried with a laptop, login into a site at home, then
> hibernate it and go somewhere (maybe you have a friend you can visit)
> and connect to the wifi, so your big surprise you will see that you are
> still logged in. If you don't have a laptop, you can use your cell phone
> first be on wifi and login, disable wifi and continue to surf.
>
> >> Yes, it will be part of the same http post, but that don't mean it will
> >> be automatically added to CSRF request.
> >
> > The are part of the same http request, but not of the CSRF request ?
You
> > have to explain that one to me I'm afraid.  And no, I'm not going to
scour
> > that site in search of what you might be thinking of.  Either you link
to or
> > quote it, or I'm going to consider this matter closed (don't want to
waste
> > more time at it as I've already done).
>
> Cookies are automatically added to a request to a page which has a
> cookie on your browser. Data that must be sent with a POST/GET/PUT do
> not be added automatically to a request which a third party request
> makes in your browser.
>
> As the CSRF request will have your IP (as it's your browser executing
> it), binding the session to the IP will not protect you.
>
> >> Yes, if he finds current one, he will find the previous one too,
> >
> > Nope.   And believe me, as thats my experience with searching the
interwebs
> > speaking there.  Sometimes you can, but more often you don't.
>
> Stop using obscure search engines then.
> --
>
>  file://Aho

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Ecommerce site - how? bit-naughty@hotmail.com - 2017-06-25 05:42 -0700
  Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-25 15:30 +0200
    Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-25 16:03 +0200
    Re: Ecommerce site - how? gordonb.y152t@burditt.org (Gordon Burditt) - 2017-06-26 05:43 -0500
      Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-26 17:12 +0200
        Re: Ecommerce site - how? "Christoph M. Becker" <cmbecker69@arcor.de> - 2017-06-26 17:54 +0200
          Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-26 19:40 +0200
            Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-26 21:42 +0200
              Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-26 23:14 +0200
                Re: Ecommerce site - how? "Christoph M. Becker" <cmbecker69@arcor.de> - 2017-06-27 00:28 +0200
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 10:48 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-27 07:56 +0200
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 12:27 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-27 19:15 +0200
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 22:01 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-28 07:07 +0200
                Re: Ecommerce site - how? Gordon Burditt <gordon@hammy.burditt.org> - 2017-06-30 17:08 -0500
        Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-26 18:29 +0200
          Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-26 19:17 +0200
            Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-26 13:34 -0400
              Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-26 20:11 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-26 21:31 +0200
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-26 22:29 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-27 07:19 +0200
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 11:24 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-27 19:43 +0200
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 23:09 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-28 07:12 +0200
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-27 21:10 -0400
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-26 16:32 -0400
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 10:30 +0200
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-27 08:38 -0400
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 17:47 +0200
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-27 12:16 -0400
                Re: Ecommerce site - how? gordonb.bytf1@burditt.org (Gordon Burditt) - 2017-06-29 18:16 -0500
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-29 20:41 -0400
                Re: Ecommerce site - how? gordonb.99a3p@burditt.org (Gordon Burditt) - 2017-06-29 23:39 -0500
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-30 07:28 -0400
                Re: Ecommerce site - how? Stefan+Usenet@Froehlich.Priv.at (Stefan Froehlich) - 2017-06-30 13:48 +0000
                Re: Ecommerce site - how? gordonb.gcghn@burditt.org (Gordon Burditt) - 2017-06-30 16:15 -0500
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-30 22:35 -0400
                Re: Ecommerce site - how? Richard Damon <Richard@Damon-Family.org> - 2017-06-29 23:46 -0400
        Re: Ecommerce site - how? gordonb.d2wed@burditt.org (Gordon Burditt) - 2017-06-29 17:32 -0500
  Re: Ecommerce site - how? bit-naughty@hotmail.com - 2017-06-27 10:58 -0700
    Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-27 15:34 -0400
    Re: Ecommerce site - how? gordonb.4psc7@burditt.org (Gordon Burditt) - 2017-06-30 16:55 -0500
      Re: Ecommerce site - how? bit-naughty@hotmail.com - 2017-07-01 03:03 -0700
        Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-07-01 09:30 -0400
        Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-07-01 09:34 -0400

csiph-web