-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Ok, quick update, I've done a basic assessment of the additional security impact of global session cookies and some mitigration strategies:
http://www.mediawiki.org/wiki/Global_session_threat_assessment
- -- brion vibber (brion @ wikimedia.org)