On 3/7/06, David Binger  wrote:
>
> On Mar 7, 2006, at 5:05 PM, Mike Orr wrote:
>
> > TG signs the auth cookie cryptographically to prevent
> > session hijack; I don't think Quixote does.
>
> Can you explain how this provides additional security?

I don't know; they just thought it was important.  Here's what Jeff
Watkins posted when I asked about this:

Mike, there are two primary reasons for using a unique cookie for the
identity framework. The first is that not everyone is going to have
the session filter enabled. The second, and far more important reason,
is that the identity cookie is signed using an SHA1 hash. This means
the cookie is "pretty secure".

You're unlikely to need to worry about someone spoofing an identity
cookie. This means it's unlikely that someone would be able to
generate a valid identity cookie. You still have to worry about
someone sniffing the cookie and using it. But I have some ideas on
that front too. We'll probably see them either post 0.9 or post 1.0.

I'll send you his email offline if you want to ask him about it.

--
Mike Orr 
(mso@oz.net address is semi-reliable)