Re: Security in displaying arbitrary HTML

[Nick Tonkin]

On Thu, 27 Apr 2000, Marc Slemko wrote:

> Cookies are not secure and will never be secure.  They may be "good
> enough", and you may not have much choice, but they are still simply not
> secure when you put everything together.

Can you be more specific about why you say that? If I set an encrypted,
short-lived cookie upon validated authentication, why is that any less secure than any
of the other approaches you mentioned?


- nick