I'm experminenting by copying and pasting cookies from one browser to the other. I came to the conclusion that it's very easy for a attacker to log in to your account when he has your cookies.
This is a part of a highly secured website:
If a withdrawal is requested from a new IP address you will receive an email asking you to check and verify the withdrawal. The 'untrusting' period for IP changes is 24 hours. If the withdrawal is made more than 24 hours after the IP address change, this extra email check is not triggered.
Question: If a attacker hijacks my session, can the website see that there are 2 sessions active with 2 different IP adresses? Or do they just see the new IP address when you manually log in using your credentials?