> The fact of the matter is how can the scanning company "know" > what cookie values you are using to track sessions unless they > can see your code. They can't unless they can successfully > demonstrate a session highjacking with your server. That > means they are guessing. That whole bit kind of irks me.
It used to irk me too, but the scans from some providers (SecurityMetrics and McAfee Secure) have been extremely thorough in my experience. They are also always adding new tests to the scans. As a result of those scanners our programming team approaches things a lot more carefully now. It engenders a more security-conscious mindset which is beneficial to all of your projects going forward. Sure, some of the things they do are annoying, but I think there is a net benefit. -Justin ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Want to reach the ColdFusion community with something they want? Let them know on the House of Fusion mailing lists Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:330770 Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4
