On: Ask HN: Why not to bind cookie to IP-address of the user? (Facebook and Tunisia)

[Khao]

It's not possible to do this as with certain ISPs that assign dynamic IPs or inside large buildings that have multiple outgoing IPs, one user can have a different IP for different requests made at the same time.

[pankratiev → Khao]

Ohh, I missed the problem with dynamic IPs. But what about MAC-address, why browsers don't bind the cookie to the MAC-address of the computer?

[mooism2 → pankratiev]

Browsers? You mean web servers, surely? Servers don't know the client's mac address.

[pankratiev → mooism2]

In the post I meant server-side, in my comment I meant client-side.

The general question - why not to bind the cookie to some other identifier of the user or user's computer to make cookie useless in thief's hands.

[mooism2 → pankratiev]

In general, the attacking computer can pretend to have the characteristics of the impersonated computer.

[Khao → pankratiev]

Then again, if someone would go the lengths to hack into someone else's account, I think it's possible to spoof a MAC-address.

[pankratiev → Khao]

You are right, in the case of Facebook in Tunisia - providers could inject the code which store user's cookie and MAC-address. My idea is useless. :-(

[ewams → pankratiev]

There is no way the server would know the mac address of the client unless the browser stores and shares that information. This is not how currently implemented networking protocols work.