CATCHING COMPROMISED COOKIES

Summary from the TLDR InfoSec newsletter

This post details how Slack detects compromised session cookies to prevent session hijacking. Slack Initially attempted to build its system by looking at the last accessed timestamp of a particular cookie to determine session forking but quickly determined that this led to a lot of false positives and added more information such as the IP address. The post also examines how performance concerns were mitigated and the rollout procedure.