[Dailydave] ASP.Net viewstate

[dvorak]

> Hi List,
> 
<SNIP>
If I am not mistaken viewstate holds some kind of HMAC
like thingy inside, something like: 
hash(data in viewstate || server_key). Which might make
changing the viewstate a bit harder, or impossible
depending on the actual implementation. You should be
able to see it in the (base64) decoded viewstate, binary
data probably 16/20/32 bytes in length.

hf.