[erlang-questions] Erlang cookies are secure

[zxq9]

On 2016年6月10日 金曜日 07:18:51 you wrote:
> Heya
> 
> With the given examples each entity had their own password/key/secret, so a
> breach means one node is secure, rather than all of them. Additionally each
> piece of functionality can require different permissions, and not all nodes
> can have permissions to request all tasks, so the scale of the potential
> damage done is lower.
> 
> Additionally one can rotate those values easily, this seems like it would
> be much harder to do with cookies.

Changing cookies is certainly an issue, but the partitioning issue is
almost entirely moot these days. With single-sign-on via Kerberos, LDAP
and especially let's-just-pretend-its-secure web auth systems that have
a tendency to place a person's (and sometimes by extension entire
organization's) data, management controls and platforms just one
(publicly known) email and password away from complete compromise.

How many companies are keeping systems-critical credentials in
plain text within config files on s3 or private github repos? How
many organizations have come to depend *entirely* on Google or fb
credentials?

This is the trend today -- to sacrifice security for usability, and it
is a pretty steep tradeoff.

My point isn't that cookies are secure -- I don't believe that they are.
My point is that cookies are not inherently *less* secure than the mass
of SSO schemes I have begun to see sprout up everywhere the word "cloud"
is used.

-Craig