Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firesheep: Easy HTTP session hijacking from within Firefox

codebutler.com

Post reply on HN
Print view View original

191–200 of 356 posts

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#191

Post by pmjordan »

timcraft wrote: post #187
pmjordan wrote: post #181

Earlier quoted context omitted.

How many new servers are going to be needed now that https is used for everything and requests can't be cached? The main thing holding us back there are browsers that go apeshit if you load images via HTTP on an HTTPS page. Requiring JavaScript or other active content to be loaded from the same HTTPS server would be a good thing in many cases. I think currently ANY https server is allowed, which doesn't actually defe…

http://stackoverflow.com/questions/954327/hidden-features-of...

That will still load images via https, not http. They'll still be cached client-side of course, but they can't be cached by proxies and you need an SSL certificate for your static content server.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#192

Post by robhu »

mrgordon wrote: post #160
charlesshonston wrote: post #138

So wait... this works regardless of wireless card? I've tried to use BackTrack on my mac before and it failed due to the card not being able to run in passive mode.

Yes, I believe it should work on any wireless card because you're not doing packet injection.

It doesn't work on my late 2009 MBP (sniffs sessions from other browsers on my laptop but not other laptops on our wifi).

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#193

Post by hdeshev »

gaoshan wrote: post #121

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…

You, sir, made my day! I just set this up with my home Linksys router which is reachable from the internet and it works like a charm.

I am using the Tomato firmware (http://www.polarcloud.com/tomato) which has an SSH daemon.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#194

Post by cousin_it »

ramanujan wrote: post #154

There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft". How many millions of dollars and man hours is it going to take to lock down every access point…

America was a better place when people could keep their doors unlocked, and when someone's first response to a break-in was to blame the criminal.

The analogy is not complete because in our situation there's a third party involved beside the victim and the criminal: the website. What if your bank leaves the vault unlocked so anyone can take your money? Isn't the bank at least partly to blame?

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#195

Post by ddrager »

I think this should be a call to arms to network, web and system admins everywhere. This is a problem that everyone knows about but nobody wants to do anything about since it requires additional setup. Usually the barrier is a technical issue that the end user can't figure out. However since submitting forms via SSL is something the developer can do without impacting the end user at all, this is a simple fix for just about any website. You need a static IP and an SSL certificate, and they are both cheap.

Running out of IPv4 space is an issue in this regard, but hopefully with more people wanting SSL it will push providers to IPv6 quicker. Nicely done EricButler!

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#196

Post by al_james »

pornel wrote: post #183
al_james wrote: post #161

What does this mean for HTTP basic authentication? How about digest access authentication?

Basic is useless - sends password in the clear. Digest authentication is safe against passive sniffing (it doesn't exchange any password/token in the clear and uses nonces), but it doesn't protect against active attacker who could modify server headers and replace "Digest" with "Basic" to reveal password.

Ok, so digest authentication is safe against this new firefox extension?

If so, why don't facebook et al. switch to digest based authentication?

Surely its better than unencrypted cookie based logins. Is it just that its ugly (the browser login popup)?

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#197

Post by dekz »

robhu wrote: post #165

On my Macbook Pro (purchased 1 year ago) it doesn't seem to be able to capture traffic on my wifi. It can see sessions originating from another browser on the same Mac, but not other macs on the wifi network. Is there a way of debugging what's going on?

Which sites are you using this on? It only works on a few select sites (and you can add more with some more javascript code). It worked for me on my MBP on the main sites, twitter some igoogle.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#198

Post by robhu »

dekz wrote: post #197
robhu wrote: post #165

On my Macbook Pro (purchased 1 year ago) it doesn't seem to be able to capture traffic on my wifi. It can see sessions originating from another browser on the same Mac, but not other macs on the wifi network. Is there a way of debugging what's going on?

Which sites are you using this on? It only works on a few select sites (and you can add more with some more javascript code). It worked for me on my MBP on the main sites, twitter some igoogle.

I tried it on Facebook.

I have a WPA2 protected Wifi network. Two laptops (a MB and a MBP) on it. I run it on the MBP, on the MB I refresh a logged in Facebook page, and nothing appears as captured on the MBP.

If on the MBP I refresh Facebook in another browser it appears.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#199

Post by ra88it »

cousin_it wrote: post #194
ramanujan wrote: post #154

There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft". How many millions of dollars and man hours is it going to take to lock down every access point…

America was a better place when people could keep their doors unlocked, and when someone's first response to a break-in was to blame the criminal. The analogy is not complete because in our situation there's a third party involved beside the victim and the criminal: the website. What if your bank leaves the vault unlocked so anyone can take your money? Isn't the bank at least partly to blame?

In parent's analogy, the third party is the door manufacturer.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#200

Post by jonknee »

robhu wrote: post #198
dekz wrote: post #197

Earlier quoted context omitted.

Which sites are you using this on? It only works on a few select sites (and you can add more with some more javascript code). It worked for me on my MBP on the main sites, twitter some igoogle.

I tried it on Facebook. I have a WPA2 protected Wifi network. Two laptops (a MB and a MBP) on it. I run it on the MBP, on the MB I refresh a logged in Facebook page, and nothing appears as captured on the MBP. If on the MBP I refresh Facebook in another browser it appears.

Try on an open wireless network.
Post reply on HN