Dan Kaminsky, the security researcher who found a major flaw in the domain name system in 2008 and recently founded a new company devoted to securing Web applications, says that a rickety sessionmanagementsystem combined with a record number of users led to the tangled logins.