Can Session object protected sites be hacked?
For example:

<!--This is the login page. If the correct uid and pwd
are entered then a session object is created-->
<%
If Request("User") = "Tom" And Request("Pwd") = "secret" Then
Session(Access") = "Granted"
End If
%>

Then at the top private.asp

<%
If Session(Access") <> "Granted" Then
Response.Redirect("Logon.asp")
End If
%>
<html>

...


THanks