2

What I can think of is by IP address, but this won't work for corporations where everyone has the same address.

Otherwise cookies might work, but this will make faking happen easily here.

How exactly does SO do the job?

Improve this question
7
  • Cookies. meta.stackexchange.com/questions/44557/…
    – kennytm
    May 3, 2010 at 15:32
  • Then everyone can pretend to be another guy by changing the cookie manually,right?
    – Gtker
    May 3, 2010 at 15:33
  • 1
    @Gtker: yes, you can pretend to be another guy (gal?) by changing the cookie.
    – MusiGenesis
    May 3, 2010 at 15:38
  • 2
    @MusiGenesis: dude, you are right again! How do you know so much? Can I have your autograph?
    – MusiGenesis
    May 3, 2010 at 15:38
  • 2
    Crap, I guess it doesn't work.
    – MusiGenesis
    May 3, 2010 at 15:38
  • Better than a 12 step program, this interest in spoofing. Soon you will find your IP banned.
    – Sky Sanders
    May 3, 2010 at 17:08
  • I find this very interesting, as I had a classmate 'stalk' me to SO and contacted the team directly. I asked if users could be tracked by ip address and this is reassuring. And no - I didn't want to know his ip address, I just gave the team his details and location for them to check for themselves.
    – user310756
    Jun 26, 2013 at 17:49

1 Answer 1

Reset to default
4

Yes, they use cookies. As everyone else. Even Google uses cookies. Microsoft too. No big deal. Session fixation is on paper indeed an easy hack. But you yet have to figure the actual cookie value and hope that it's not locked to a certain IP address. Now that is a hard hack. Guessing the password is easier.

Now, if you think you're so good, what's the cookie value of my SO account? Three .. two .. one .. NOW!

Improve this answer
1
  • 1
    Was the OP here trying to work out how to scam the system?
    – user310756
    Jun 26, 2013 at 17:43

You must log in to answer this question.