[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: eyeOS checksum prediction
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: Re: eyeOS checksum prediction
- From: jose@xxxxxxxxx
- Date: 19 Sep 2007 03:59:40 -0000
I think that you don't understand the idea behind the checkNUM (is not a
checkSUM ;) in the eyeOS ajax calls.
the checknum, is a number to protect eyeOS againt automatic requests, for
example, if I'm using my eyeOS, my session is alive, and I enter another
website, with iframes or something similar, for make a get to my eyeOS to
delete a file, a file will be deleted, and this isn't good :)
the checknum DO NOT protect against yourself, the owner of a session, can know
the checknum assigned to each app (each app have a different checknum)
Please, before send FALSE reports, you have to understand what you are
auditing, thanks.