Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firesheep: Easy HTTP session hijacking from within Firefox

codebutler.com

Post reply on HN
Print view View original

41–50 of 356 posts

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#41

Post by wizard_2 »

uptown wrote: post #37

The explanation I've always heard for not using HTTPS 100% of the time is that it puts an substantial load on the server, and for many sites it's overkill. Setting aside the subjective topic of "overkill" ... how much more CPU-intensive is it to serve pages over HTTPS compared to HTTP?

The cpu load can be mitigated with frontend https accelerators or proxies (think nginx as a load balancer doing the https). The real problem is the first connection. Browsers don't fall back to https, if nothing answers on http they'll give an error. If the first connection is over http then a man in the middle attack can succeed.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#42

Post by spicyj »

sdurkin wrote: post #38
ElbertF wrote: post #36

Why don't Facebook and other major sites check the user agent and IP address of client as well, instead of just relying on a cookie? That would solve this problem in 99% of the cases, right?

If you're on the same wireless network as someone, you have the same external IP address.

And of course, if you can see the traffic, you can spoof the same User-Agent as well.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#44

Post by qeorge »

StavrosK wrote: post #35
ryan-allen wrote: post #33

Earlier quoted context omitted.

I've had a bit of a look on Google, but I'm not 100% sure which provider you mean? Where can you get free SSL certificates that don't upset browsers?

Ah, I can't remember the name now... Rapidssl? That's probably it. Check historio.us, the ssl cert there is a free one (which is, sadly, why subdomains don't validate). EDIT: I searched and it's actually http://cert.startcom.org/ .

Check historio.us, the ssl cert there is a free one (which is, sadly, why subdomains don't validate).

AFAIK this is common to all certs (free or otherwise). You need a separate one for each subdomain (including www).

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#45

Post by StavrosK »

qeorge wrote: post #44
StavrosK wrote: post #35

Earlier quoted context omitted.

Ah, I can't remember the name now... Rapidssl? That's probably it. Check historio.us, the ssl cert there is a free one (which is, sadly, why subdomains don't validate). EDIT: I searched and it's actually http://cert.startcom.org/ .

Check historio.us, the ssl cert there is a free one (which is, sadly, why subdomains don't validate). AFAIK this is common to all certs (free or otherwise). You need a separate one for each subdomain (including www).

No, there are also wildcard certificates that match all subdomains, but are rather more expensive.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#46

Post by walkon »

bluesmoon wrote: post #32
Groxx wrote: post #13

Nice . A solid demonstration to show next time your webmaster doesn't want to set up SSL everywhere. That said, the current cartel-like setup of certificate authorities (protection money and everything!) makes SSL annoying and expensive if you want the browser to not have a fit. Especially for small-scale projects. But there's really no excuse for larger sites.

SSL is bad for the environment because it requires far more server side hardware... Well, I'm only partially serious about the environment thing, the question is, how can internet companies make it commercially viable to use SSL for everything? The added hardware and power costs make each user way more expensive, possibly to the point where they may not actually be worth it. An alternative is to bind the user's sessi…

Require SSL on any request who's response sends a set-cookie http header. Leave it out for the non-sensitive request/responses.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#47

Post by carbon8 »

This is kind of a big deal. Not a whole lot of people are aware of this vulnerability and among those who are it's likely only a small subset that knew how to exploit it until now. I suspect all of the coffee shops in the college town where I live will have people using this starting tomorrow.

I've personally been working from cafes and tunneling everything through SSH for years, but in my experience almost no one else does this.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#48

Post by ElbertF »

sdurkin wrote: post #38
ElbertF wrote: post #36

Why don't Facebook and other major sites check the user agent and IP address of client as well, instead of just relying on a cookie? That would solve this problem in 99% of the cases, right?

If you're on the same wireless network as someone, you have the same external IP address.

I realize that but at least my neighbors won't be able to hijack my session from home. Logging in over a public network always seems risky.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#49

Post by wwortiz »

gregwebs wrote: post #31

What can an end user do to minimize this? This exploit is for insecure Wifi networks- so only using encrypted Wi-fi or Ethernet would seem to remove this attack vector. Is there a real risk that someone (besides the government) can see your cookie?

Is there a real risk that someone (besides the government) can see your cookie?

Yes, if you login and your cookie is sniffed and spoofed then basically you just allowed the attacker to login as you at the same time.

Minimizing it is a little bit different: you can use a secure proxy/tunnel, you can limit your unencrypted wireless activity, you can make sure that sites that should be SSL encrypted are (stripping SSL is common when password sniffing) and you can avoid these services while on open wifi networks.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#50

Post by amanuel »

You can slightly reduce the dangers stated here by logging out immediately after you are done doing whatever it is you are doing. This will make the captured session useless.

The best solution is of course to get a VPN acct and use it when you are at free/open wifi spots. I use WiTopia (www.witopia.net)

Post reply on HN