Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hijacking user sessions with the Heartbleed vulnerability

mattslifebytes.com

Post reply on HN
Print view View original

1–10 of 70 posts

Re: Hijacking user sessions with the Heartbleed vulnerability

#2

Post by pearjuice »

This is one of these things of which you think "Ah, what are the odds of me being affected?" but quickly changing to "This is pretty bad..." and finally to "FUCK FUCK FUCK, WHY?".

Two years is a long time, people. If ordinary people can write proof of concepts in less than 24 hours after it is publicly disclosed, what to think of those getting paid to find and abuse such bugs? I mean, what are the odds this bug was not abused in production environments the past two years?

Re: Hijacking user sessions with the Heartbleed vulnerability

#5

Post by M4v3R »

pearjuice wrote: post #2

This is one of these things of which you think "Ah, what are the odds of me being affected?" but quickly changing to "This is pretty bad..." and finally to "FUCK FUCK FUCK, WHY?". Two years is a long time, people. If ordinary people can write proof of concepts in less than 24 hours after it is publicly disclosed, what to think of those getting paid to find and abuse such bugs? I mean, what are the odds this bug was n…

It might be a coincidence, but last month I received an alert that someone tried to sign in to my hosting control panel using a correct password (which was long and random), but was blocked by a geo-filter (which blocks requests outside of my country) fortunately. I do not know up to this day how my password did leak, and that's one possible candidate cause.

Re: Hijacking user sessions with the Heartbleed vulnerability

#6

Post by Bootvis »

For SSH it's common to use private keys to communicate securely with servers using public key cryptography. This is convenient and protects against key loggers.

What are the possibilities of using public key cryptography in the browser? For example, I upload my public key to some website, create an account which is locked to my private key. I get the convenience of not having to log in manually and some extra safety.

Re: Hijacking user sessions with the Heartbleed vulnerability

#7

Post by mikeash »

Bootvis wrote: post #6

For SSH it's common to use private keys to communicate securely with servers using public key cryptography. This is convenient and protects against key loggers. What are the possibilities of using public key cryptography in the browser? For example, I upload my public key to some website, create an account which is locked to my private key. I get the convenience of not having to log in manually and some extra safety.

I believe what you're describing is encompassed by SSL client certificates. They're supported, but roughly nobody uses them for some reason.

Re: Hijacking user sessions with the Heartbleed vulnerability

#8

Post by dfc »

Bootvis wrote: post #6

For SSH it's common to use private keys to communicate securely with servers using public key cryptography. This is convenient and protects against key loggers. What are the possibilities of using public key cryptography in the browser? For example, I upload my public key to some website, create an account which is locked to my private key. I get the convenience of not having to log in manually and some extra safety.

It is possible and has been for some time. Like many other PKI systems it is a pain in the ass to configure on the server (atleast it was with apache) and teaching/getting users to generate keys is a nightmare.
Post reply on HN