Hacker News Reader

Ohh, I missed the problem with dynamic IPs. But what about MAC-address, why browsers don't bind the cookie to the MAC-address of the computer?

View on HN

Browsers? You mean web servers, surely? Servers don't know the client's mac address.

In the post I meant server-side, in my comment I meant client-side.

The general question - why not to bind the cookie to some other identifier of the user or user's computer to make cookie useless in thief's hands.

In general, the attacking computer can pretend to have the characteristics of the impersonated computer.

Then again, if someone would go the lengths to hack into someone else's account, I think it's possible to spoof a MAC-address.

You are right, in the case of Facebook in Tunisia - providers could inject the code which store user's cookie and MAC-address. My idea is useless. :-(

There is no way the server would know the mac address of the client unless the browser stores and shares that information. This is not how currently implemented networking protocols work.

Reply on news.ycombinator.com