Re: [http-state] Security considerations overview

[David Morris <[e-mail]>]

On Tue, 2 Mar 2010, Adam Barth wrote:

>         <t>Transport-layer encryption, such as HTTPS, is insufficient to
>         prevent a network attacker from altering a victim's cookies because
>         the cookie protocol does not provide integrity.  By default, cookies
>         are transmitted in the clear, where their confidentiality can be
>         compromised by a network attacker.</t>

I don't under stand how the second sentence extends the thought in the 
first sentence. It seems in conflict in the sense that HTTPS is not
sending cookies in the clear and use of HTTPS is generally recommended
as the way to avoid compromise by network hackers. What am I missing?