PHP session_regenerate_id(true)
http://www.php.net/manual/en/function.session-regenerate-id....
Firesheep: Easy HTTP session hijacking from within Firefox
351–356 of 356 posts
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#352Isin't this extension great ? =D
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#353Re: Firesheep: Easy HTTP session hijacking from within Firefox
#354Earlier quoted context omitted.
No, you misunderstood. It's enough to protect you against random people sniffing wireless packets. Not other people that are on your network.
Your terminology "the network" or "your network" is still unclear; encryption to the AP could be unique per wireless network client, or not. If it is unique per client -- and it is my belief that recent standards, like WPA2 at least, provide this -- then casual passive eavesdropping by other wireless clients (as with the FireSheep tool) is thwarted. (And that's what most people are most concerned about.) Are you sugg…
WPA enterprise allows a separate (changing) key for each user, typically what you get from an RSA token. Once it gets to the AP, it's then clear text (assuming HTTP) over the rest of the internet until it hits your (HTTP) service provider.
If you have control over the internet between the AP and your server, then you're safe. If you don't, then how safe you are depends on how much you can trust the owner of each router along the way. In general, you should be okay, except that every now and then you might end up on an untrusted router, and it's then game over.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#355Earlier quoted context omitted.
Mind providing more information on this? eg, what about WPA2+TKIP? I'm trying to wrap my head around how WPA2 could still provide protection with a shared key... I'm sure I'm not the only geek who feels like their knowledge of WiFi protocols goes stale every six months or so.
TKIP is much more vulnerable. In theory it requires "work" to crack WPA2+TKIP but it's comparatively trivial with modern hardware. With WPA2+AES you basically open a public/private key encrypted connection to the router (similar to SSL) and exchange the PSK in order to authorize the client. This traffic isn't any more sniffable, in principle, than https traffic. However, depending on configuration it can be vulnerabl…
Actually this is false. I have actually read the 802.11i spec and I think the way the key exchange is done is same regardless of whether TKIP or CCMP is used.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#356Earlier quoted context omitted.
This is incorrect. Traffic on an access point using WPA2 + AES is not sniffable without significant cryptanalysis or use of exploits.
It's fairly easy to do if you are logged in on the network already. For example, for the iPhone you can use something like pirni to spoof the mac address of the router. That way you'll receive all data on the network, and can send it on the router yourself. In the meantime, you can dump all cookies that are passed on. I think the tool even allows you to list all twitter and google cookies, and set them in Safari.
Yep, if you are wondering what Hole196 was about, it was about this kind of attack.