What does this mean for HTTP basic authentication? How about digest access authentication?
Firesheep: Easy HTTP session hijacking from within Firefox
161–170 of 356 posts
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#162For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…
Also, if you host your ssh server on 443 rather than 22, you can also tunnel through most corporate firewalls.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#163For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…
Also, remember that some programs don't respect the system's proxy settings and instead use their own. Firefox is one of those, you can find its proxy settings in "Advanced -> Network -> Settings"
http://lifehacker.com/237227/geek-to-live--encrypt-your-web-...
That link has screenshots to help you configure Firefox to use the ssh proxy.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#164Earlier quoted context omitted.
Yes, assuming you know the password to connect to the network. Otherwise no.
This is incorrect. Traffic on an access point using WPA2 + AES is not sniffable without significant cryptanalysis or use of exploits.
Mind providing more information on this? eg, what about WPA2+TKIP?
I'm trying to wrap my head around how WPA2 could still provide protection with a shared key... I'm sure I'm not the only geek who feels like their knowledge of WiFi protocols goes stale every six months or so.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#165On my Macbook Pro (purchased 1 year ago) it doesn't seem to be able to capture traffic on my wifi. It can see sessions originating from another browser on the same Mac, but not other macs on the wifi network.
Is there a way of debugging what's going on?
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#166There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft". How many millions of dollars and man hours is it going to take to lock down every access point…
This is IMO a completely wrong approach to security. Butler has not raised the threat level, he has merely illuminated the existing threat level.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#167It would help a bit if there was a way to automatically encrypt sessions on an open wifi access point without requiring a password to connect.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#168For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…
ssh -ND 8887 -p 22 rufus@12.120.186.8
ssh -vND 8887 -p 22 rufus@12.120.186.8
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#169Why don't Facebook and other major sites check the user agent and IP address of client as well, instead of just relying on a cookie? That would solve this problem in 99% of the cases, right?
If you're on the same wireless network as someone, you have the same external IP address.
Yet another reason NAT sucks...
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#170There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft". How many millions of dollars and man hours is it going to take to lock down every access point…
People have been doing this for years already with tools like Wireshark. The only thing the app he has released does it to draw a massive amount of attention to the already existing problem. I say superb. Brilliant effort. Well done. Hopefully more people will stop stupidly sending session cookies over unsecured channels now.