Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firesheep: Easy HTTP session hijacking from within Firefox

codebutler.com

Post reply on HN
Print view View original

261–270 of 356 posts

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#261

Post by ifesdjeen »

pauldino wrote: post #63
uptown wrote: post #37

The explanation I've always heard for not using HTTPS 100% of the time is that it puts an substantial load on the server, and for many sites it's overkill. Setting aside the subjective topic of "overkill" ... how much more CPU-intensive is it to serve pages over HTTPS compared to HTTP?

There was a great write-up of a talk on SSL/TLS performance at Google linked here a few months back ( http://unblog.pidster.com/imperialviolet-overclocking-ssl , HN discussion at http://news.ycombinator.com/item?id=1485425 ) Quoting from that, "On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead."

OK, that's most likely too late to contribute to the stated article, but there was a talk by Michael Klishsin about a year ago, here're his slides: http://bit.ly/90qORL (ssl, performance, certificates, lots of stuff)

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#263

Post by seabee »

Dornkirk wrote: post #260
gaoshan wrote: post #121

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…

This is a stupid question, but what about a guy like me who has no access to a server? I'm going traveling for all of next month, the only sites I'll be checking where I'll be logged in is my hotmail account, and I might check my bank account (Chase) - both use https, so I suppose I'm in the clear then? (also when I click "log out" on these sites, it logs me out, but if my session has been hijacked, will it log the h…

Generally websites will delete the login token on their side, leaving hijackers with an invalid token and a 'log in again' page.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#264

Post by retroafroman »

Dornkirk wrote: post #260
gaoshan wrote: post #121

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…

This is a stupid question, but what about a guy like me who has no access to a server? I'm going traveling for all of next month, the only sites I'll be checking where I'll be logged in is my hotmail account, and I might check my bank account (Chase) - both use https, so I suppose I'm in the clear then? (also when I click "log out" on these sites, it logs me out, but if my session has been hijacked, will it log the h…

A cheap linux VPS is a couple bucks a month. Mine is three. If you aren't looking for a deal, there are many many options at the 5 dollar price point. If five bucks is worth peace of mind for the next month, then that's your answer. This will also have the benefit of getting around filters that are operating on WiFi network you are on.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#265

Post by artlogic »

dhyasama wrote: post #226
gaoshan wrote: post #121

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…

Are there public SSH servers that are safe?

Not that I know of, but decent VPSes are relatively cheap - for instance: $5/mo - http://prgmr.com/

If you can't afford that, you can always run a SSH server from your residence and use that.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#266

Post by dpritchett »

retroafroman wrote: post #264
Dornkirk wrote: post #260

Earlier quoted context omitted.

This is a stupid question, but what about a guy like me who has no access to a server? I'm going traveling for all of next month, the only sites I'll be checking where I'll be logged in is my hotmail account, and I might check my bank account (Chase) - both use https, so I suppose I'm in the clear then? (also when I click "log out" on these sites, it logs me out, but if my session has been hijacked, will it log the h…

A cheap linux VPS is a couple bucks a month. Mine is three. If you aren't looking for a deal, there are many many options at the 5 dollar price point. If five bucks is worth peace of mind for the next month, then that's your answer. This will also have the benefit of getting around filters that are operating on WiFi network you are on.

Wow, three? I thought prgmr.com's $5 system was the best deal I'd be able to find.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#267

Post by _cbsz »

StavrosK wrote: post #45
qeorge wrote: post #44

Earlier quoted context omitted.

Check historio.us, the ssl cert there is a free one (which is, sadly, why subdomains don't validate). AFAIK this is common to all certs (free or otherwise). You need a separate one for each subdomain (including www).

No, there are also wildcard certificates that match all subdomains, but are rather more expensive.

Wildcard certs don't match the underlying domain, though. See, for example, dropbox.com instead of www.dropbox.com; they've got a wildcard cert and it's not valid for dropbox.com.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#268

Post by retroafroman »

dpritchett wrote: post #266
retroafroman wrote: post #264

Earlier quoted context omitted.

A cheap linux VPS is a couple bucks a month. Mine is three. If you aren't looking for a deal, there are many many options at the 5 dollar price point. If five bucks is worth peace of mind for the next month, then that's your answer. This will also have the benefit of getting around filters that are operating on WiFi network you are on.

Wow, three? I thought prgmr.com's $5 system was the best deal I'd be able to find.

It was a special deal featured on http://www.lowendbox.com/. If you can pay by the year, there are even cheaper deals.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#269

Post by _cbsz »

mcmc wrote: post #90

It seems fine to just enable SSL everywhere. But indulge me for a second in thinking of alternate solutions. Instead of sending a cookie, send a piece of javascript code (as part of the SSL-cloaked login handshake) that generates a new cookie for each request, and consider each new cookie in this sequence a "one time use" token. You can turn off SSL for subsequent requests and just use one of these new cookies each t…

Haven't thought too hard about passive attacks, but you're not secure against an active MITM like airpwn (http://airpwn.sourceforge.net/Airpwn.html), because the MITM can inject JS into the unencrypted content that steals your JS security scheme's secrets. Effectively, an active MITM allows XSS on plain ol' HTTP sites.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#270

Post by gaoshan »

Dornkirk wrote: post #260
gaoshan wrote: post #121

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…

This is a stupid question, but what about a guy like me who has no access to a server? I'm going traveling for all of next month, the only sites I'll be checking where I'll be logged in is my hotmail account, and I might check my bank account (Chase) - both use https, so I suppose I'm in the clear then? (also when I click "log out" on these sites, it logs me out, but if my session has been hijacked, will it log the h…

I would consider paying for VPN access. I travel a bit and use Witopia for this. It's not very expensive and is quite convenient.
Post reply on HN