The Cracked Cookie Jar: HTTP Cookie Hijacking and the Exposure of Private Information
Triple Handshakes and Cookie Cutters: Breaking and Fixing Authentication over TLS