TLDR; When a service makes use of BankID to authenticate their customers it is not
uncommon for them to incorrectly implement some safety
features of the protocol which leaves them uncovered to a
Session Fixation CWE-384 vulnerability which may be used by
an attacker to hijack a victim’s session on that service.
While the principle topic of this weblog-submit was the Session Fixation assault on BankID, I've discovered that many different authentication/identification providers have all been designed with the identical flaw.
The Session Fixation bug leads to a 1-click on Account Takeover on any software that person Swedish BankID as an authentication provider and has incorrectly (or not at all) applied certificate insurance policies and ipAddress checks.
My personal opinion on that is that if you happen to develop
and function such a critical and extremely adopted authentication supplier, which is commonly used to guard very sensitive consumer data, it is best to correctly doc your safety
mechanisms so that RPs can securely integrate it.

The rationale I imagine this is more severe than just
one other vuln in a software firm is because BankID is something that's utilized by over 8.5 million Swedish residents, it’s used to log into your bank, insurance supplier,
electricity provider and other delicate platforms which have real world penalties.

Your style is really unique compared to other people I've read stuff from.

Thanks for posting when you have the opportunity, Guess
I will just book mark this web site.

Heya i am for the primary time here. I found this
board and I to find It truly helpful & it helped me out a lot.
I hope to provide one thing back and aid others such as you aided me.

Yes! Finally someone writes about AlgosOne.

Wow, this article is fastidious, my younger sister is analyzing such things, thus I am
going to convey her.