title: Hacking session variables in Asp.NET
body: <p>Is it possible to hack someone's session variables and create a new shadow user?</p>
  
  <p>What are the common ways of avoiding such surprizes? </p>
  
  <p>SSL certificate installation or ....?</p>