treacheroustalks/Treacherous-Talks — Issue #2: Session IDs are predictable
Author: jbothma
Created: 2012-01-11 10:23:26+00:00
State: open

We weren't concerned with security in this project, so no attempt was made to make session IDs used in browser cookies and XMPP and email interfaces difficult to predict.

This means it can be very easy to hijack the session of another user, and possible to hijack the session of privileged users.

This should be fixed if you'd like to avoid this.