Hacker News Reader

It does not. It is the difference between an exploit that yields a root password and one that yields a shell at uid=0.

HttpOnly is almost totally cosmetic.

It's not the same, an XSS is not comparable to a shell for the exact reason I outlined above. And a session is not a password.

I'm probably coming over as too offensive, but you really really don't seem to know what you are even talking about. You are wrong wrong wrong.

I'm pretty sure? I do know what I'm talking about here. Sorry. HttpOnly is a joke.

If you don't believe `tptacek maybe you will believe James Kettle: