Strong parameters really wouldn't solve that issue either, as you'd just have ```u.permit(:name, :email, :password, :password_confirmation, :name, :profile_image)``` in your application_controller / user_controller vs the ```attr_accessible :email, :password, :password_confirmation, :name, :profile_image``` etc that you have now. You'd also need a new gem for strong_parameters in Rails 3, or you'd have to upgrade your app to Rails 4 (vs adding attr_accessible in, where we just had to change a setting in application.rb).

I think we are going to move to Rails 4 eventually, at which point strong parameters will be added in. We'd also get the benefit of secrets.yml, which would take care of the session_store store stuff as well. But I think it's best to change as few moving parts as possible at one time. Once we deploy this security fix, and see if people have any edge case issues, we can then start moving it over piece by piece to Rails 4 (upgrading but keeping attr_accessible, then adding strong parameters, etc).

Those are at least my thoughts at least.