On: Typing the Letters A-E-S Into Your Code (2009)

[Kliment]

Plaintext SID? Couldn't you just replay that SID then? Or generate random SIDs and see what sticks?

[seszett → Kliment]

If your SIDs are large enough, it's no different from generating random encrypted cookies until one works, so not practical at all.