On Thu, Mar 20, 2014 at 03:33:09AM +0900, Yasuo Ohgaki wrote:
> > I agree. But we've got more factors here, it's not a simple tool for
> > detection
> > of crimes. If we let "old session" live for x secs, what will happen to
> > changes done to the old session? How do you want to resolve that? We should
> > find a balance between complexity and security.
> >
> >
> Currently we have poor mitigation. My proposal provides better mitigation.
I still don't see how you want to handle inconsistency between sessions. It
seems that your RFC silently ignores that issue.
Kind Regards,
Mateusz Kocielski