Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firesheep: Easy HTTP session hijacking from within Firefox

codebutler.com

Post reply on HN
Print view View original

201–210 of 356 posts

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#201

Post by bsaunder »

zecg wrote: post #166
ramanujan wrote: post #154

There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft". How many millions of dollars and man hours is it going to take to lock down every access point…

This is IMO a completely wrong approach to security. Butler has not raised the threat level, he has merely illuminated the existing threat level.

Illumination is one thing. Enabling a ten year old to do malicious stuff with a few clicks and poorly considered actions is entirely another.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#202

Post by sushrutbidwai »

ramanujan wrote: post #154

There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft". How many millions of dollars and man hours is it going to take to lock down every access point…

I will blame lock manufacturers if any damn key on the planet can open it up.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#203

Post by cpach »

cturner wrote: post #162
gaoshan wrote: post #121

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…

Also, if you host your ssh server on 443 rather than 22, you can also tunnel through most corporate firewalls.

And if the firewall does protocol blocking, solutions like http://dag.wieers.com/howto/ssh-http-tunneling/ might be able to get through.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#204

Post by blntechie »

pygy_ wrote: post #174
gaoshan wrote: post #121

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…

I'd like to buy such a server at low purchase and maintenance cost. The Pandaboard[1] looks like a good fit, but the instructions to install a Linux distro are a bit scary [2]. I guess I could do it, from my Mac, but I'm a bit afraid to mess things up with the low-level disk utilities. Does someones sells SD cards with a distro pre-installed? Or an equivalent device with an easier setup? If not, there's probably a ma…

Exactly my question. Are there any cheap and reliable(very important in this case) VPS service I can use to do this? Using ssh thru internet as proxy seems to be the best approach. Unfortunately I cannot setup my own ssh server to do this as both power and internet connectivity is not reliable where i live.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#205

Post by pornel »

al_james wrote: post #196
pornel wrote: post #183

Earlier quoted context omitted.

Basic is useless - sends password in the clear. Digest authentication is safe against passive sniffing (it doesn't exchange any password/token in the clear and uses nonces), but it doesn't protect against active attacker who could modify server headers and replace "Digest" with "Basic" to reveal password.

Ok, so digest authentication is safe against this new firefox extension? If so, why don't facebook et al. switch to digest based authentication? Surely its better than unencrypted cookie based logins. Is it just that its ugly (the browser login popup)?

Yes, Digest is safe in this case, but one could write a more advanced (packet-injecting) tool/Firefox extension that breaks Digest too.

Terribly bad UI and lack of standard way to log out are dealbreakers for HTTP auth.

There's also no reliable way to customize UI to offer help, password reminders, branding or anything like that.

There has been proposal to improve this in 1999:

http://www.w3.org/TR/NOTE-authentform

and recently discussed in HTML5 WG, but the conclusion was Digest and countless JS tricks proposed in its place are only partial solutions, cookies have unstoppable momentum, so it's better if everyone just switches to SSL.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#206

Post by evilduck »

bsaunder wrote: post #201
zecg wrote: post #166

Earlier quoted context omitted.

This is IMO a completely wrong approach to security. Butler has not raised the threat level, he has merely illuminated the existing threat level.

Illumination is one thing. Enabling a ten year old to do malicious stuff with a few clicks and poorly considered actions is entirely another.

If it can be that easily scripted, 10 year olds were already doing it. Suppressing knowledge, especially knowledge of a flawed system, doesn't make the system safer.

In terms of severity, computing has overcome worse exploits; this is a problem awaiting an answer, which sounds like opportunity to me.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#207

Post by jfager »

ramanujan wrote: post #154

There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft". How many millions of dollars and man hours is it going to take to lock down every access point…

Butler has not raised the threat level on anything. This has been a widely known issue since forever. A friend of mine wrote a sniffer that could do this back in college, and he was one of the last to the party. Want something else to kvetch about? His tool could impersonate the router and act as a proxy, including serving up ssl-encrypted pages to users who didn't realize they shouldn't accept certs from unknown signers - again, that was years ago, and even then it was nothing new or unique at all.

When a tool like this rises to even a minimum level of public consciousness, you're better off thinking "people have probably been doing this for close to a decade" than "this asshole just ruined the internet by pointing out an obvious flaw that someone will now be able to exploit".

And yes, at some point, a door manufacturer that knows how easily their doors will open and how frequently people will just walk through does take on some responsibility to add a lock (and the homeowner to use it). It's going to cost more in servers? Okay, so what? It costs more to install seatbelts, are you upset at Ralph Nader, too?

[Edited to bring it down a notch]

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#208

Post by ramanujan »

jfager wrote: post #207
ramanujan wrote: post #154

There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft". How many millions of dollars and man hours is it going to take to lock down every access point…

Butler has not raised the threat level on anything. This has been a widely known issue since forever . A friend of mine wrote a sniffer that could do this back in college, and he was one of the last to the party. Want something else to kvetch about? His tool could impersonate the router and act as a proxy, including serving up ssl-encrypted pages to users who didn't realize they shouldn't accept certs from unknown si…

> Butler has not raised the threat level on anything.

Flat out false. Ever heard the term "crime of opportunity"?

What's your over/under on the number of identity thefts facilitated by Eric Butler's little gift? Let's make this empirical.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#209

Post by ramanujan »

evilduck wrote: post #206
bsaunder wrote: post #201

Earlier quoted context omitted.

Illumination is one thing. Enabling a ten year old to do malicious stuff with a few clicks and poorly considered actions is entirely another.

If it can be that easily scripted, 10 year olds were already doing it. Suppressing knowledge, especially knowledge of a flawed system, doesn't make the system safer. In terms of severity, computing has overcome worse exploits; this is a problem awaiting an answer, which sounds like opportunity to me.

> Suppressing knowledge

Again, degrees matter. Abstract knowledge is one thing. A simple tool to facilitate griefing people is quite another.

Mobile web browsing existed before the Iphone. Search existed before Google. Telecommunication preceded the internet. You could share mp3s before Napster and mp4s before Youtube.

And you used to have to delve into Wireshark to pull this off, but now you can snag grandma's credentials from any Starbucks in the country with a mouse. Degrees do matter.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#210

Post by brlewis »

cdine wrote: post #188
kogir wrote: post #186

This is one of many reasons Loopt has used SSL for all[1] traffic from the very beginning. At least WiFi has fairly limited range. Cell networks[2] (and satellite internet[3]) can be sniffed miles away. In addition to making session hijacking harder, using SSL keeps crappy proxies from caching private data. Remember when some AT&T users were getting logged in as other users on Facebook's mobile site? The cause was a…

Indeed, Loopt appears to be one of the few high-profile sites to have done this right. SSL for everything, and cookies that are relevant to login sessions are marked secure. This is what we need everywhere!

I'm proud of http://ourdoings.com/ having done this since 2004.
Post reply on HN