Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firesheep: Easy HTTP session hijacking from within Firefox

codebutler.com

Post reply on HN
Print view View original

131–140 of 356 posts

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#131

Post by geoffbp »

EricButler wrote: post #100
bluesmoon wrote: post #32

Earlier quoted context omitted.

SSL is bad for the environment because it requires far more server side hardware... Well, I'm only partially serious about the environment thing, the question is, how can internet companies make it commercially viable to use SSL for everything? The added hardware and power costs make each user way more expensive, possibly to the point where they may not actually be worth it. An alternative is to bind the user's sessi…

When Gmail switched on SSL for everyone earlier this year they added "no additional machines" ( http://unblog.pidster.com/imperialviolet-overclocking-ssl ). Regarding IPs, there's a bigger issue here. People are used to being able to shut their laptop at home and open it back up at work without having to re-authenticate all their browser tabs. If you filter by IP this breaks. SSL requires no changes to user behavior.

interesting info in that url, thanks

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#132

Post by chrisbroadfoot »

cdine wrote: post #114
chrisbroadfoot wrote: post #82

Has anyone checked the source code to check that the passwords aren't sent to the author's website? :)

It's 100% open source! Please feel free to review it. http://github.com/codebutler/firesheep It doesn't currently do anything with passwords, it's only pulling out cookies from HTTP Response headers. But it would be trivial to also get passwords in non-HTTPS requests for logins with the same method.

Indeed. Sorry if I implied that you were doing evil things.

People should also be aware of the security implications of installing various software on their system. :)

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#133

Post by chrisbroadfoot »

gaoshan wrote: post #121

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…

And, make sure you already have the key in your known_hosts, otherwise you could be subject to a MITM attack :)

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#134

Post by chrisbroadfoot »

gojomo wrote: post #119
chrisbroadfoot wrote: post #84

Earlier quoted context omitted.

Encrypted WiFi won't stop clients on the network from sniffing your packets. It will , however, stop unauthorised computers from sniffing any network data.

I would have expected each wireless client, on an encrypted network, to negotiate its own key with the access point -- so you'd only see neighbors' traffic if the access point chose to rebroadcast it to you. Are you sure that neither WEP nor WPA/WPA2 do it this way?

The encryption is between your client and the AP. Uaually everything after that is standard IP.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#135

Post by InclinedPlane »

pmorici wrote: post #129
thought_alarm wrote: post #128

Does this kind of wi-fi sniffing work with WEP or WPA encrypted networks? What about 802.1x?

Yes, assuming you know the password to connect to the network. Otherwise no.

This is incorrect. Traffic on an access point using WPA2 + AES is not sniffable without significant cryptanalysis or use of exploits.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#136

Post by alanstorm »

gaoshan wrote: post #121

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…

Also, remember that some programs don't respect the system's proxy settings and instead use their own. Firefox is one of those, you can find its proxy settings in "Advanced -> Network -> Settings"

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#137

Post by gasull »

EricButler wrote: post #17
gasull wrote: post #14

Earlier quoted context omitted.

"Firesheep 0.1 could not be installed because it is not compatible with Firefox 3.6.9." And yes, WinPcap is installed. I don't think it should matter, but I'm running Windows XP on a VirtualBox.

Oh, you just need to update to the latest version of Firefox (3.6.11). Your version is out of date and not secure. http://www.mozilla.org/security/known-vulnerabilities/firefo...

Thanks. It works now with FF 3.6.11. Your extension is amazing.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#139

Post by mfukar »

alanstorm wrote: post #136
gaoshan wrote: post #121

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…

Also, remember that some programs don't respect the system's proxy settings and instead use their own. Firefox is one of those, you can find its proxy settings in "Advanced -> Network -> Settings"

After Firefox 3.6.4, the default proxy selection policy is to use the system default, instead of no proxy.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#140

Post by gojomo »

chrisbroadfoot wrote: post #134
gojomo wrote: post #119

Earlier quoted context omitted.

I would have expected each wireless client, on an encrypted network, to negotiate its own key with the access point -- so you'd only see neighbors' traffic if the access point chose to rebroadcast it to you. Are you sure that neither WEP nor WPA/WPA2 do it this way?

The encryption is between your client and the AP. Uaually everything after that is standard IP.

That's what I thought -- enough to protect against fellow wireless sharers, but not the hosting establishment or path through their ISP to a website.
Post reply on HN