Be careful when trying this out. You could be breaking a law or two...
Firesheep: Easy HTTP session hijacking from within Firefox
61–70 of 356 posts
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#62Why don't Facebook and other major sites check the user agent and IP address of client as well, instead of just relying on a cookie? That would solve this problem in 99% of the cases, right?
If you're on the same wireless network as someone, you have the same external IP address.
Plus, your source IP can change from request to request when your ISP transparently pushes you through one of many proxy servers. AOL does (or did) this, as do some large European ISPs whose names escape me.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#63The explanation I've always heard for not using HTTPS 100% of the time is that it puts an substantial load on the server, and for many sites it's overkill. Setting aside the subjective topic of "overkill" ... how much more CPU-intensive is it to serve pages over HTTPS compared to HTTP?
There was a great write-up of a talk on SSL/TLS performance at Google linked here a few months back (http://unblog.pidster.com/imperialviolet-overclocking-ssl, HN discussion at http://news.ycombinator.com/item?id=1485425)
Quoting from that, "On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead."
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#64Makes a strong case for everyone to start tunneling their traffic back to a trusted network.
I've been trying out sshutttle " rel="nofollow">http://github.com/apenwarr/sshuttle>. It only tunnels TCP traffic, so you still have DNS and UDP traffic on the local network.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#65Nice . A solid demonstration to show next time your webmaster doesn't want to set up SSL everywhere. That said, the current cartel-like setup of certificate authorities (protection money and everything!) makes SSL annoying and expensive if you want the browser to not have a fit. Especially for small-scale projects. But there's really no excuse for larger sites.
You can get SSL certificates for free for one domain, and they work with all browsers (except Opera, IIRC). Also, you can use Perspectives for Firefox, which I think is much better than the current system.
Perspectives doesn't work in the latest version of Firefox. Its home page says a new version is coming, though:
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#66Re: Firesheep: Easy HTTP session hijacking from within Firefox
#67Earlier quoted context omitted.
Thanks! If you or anyone has any problems, email me (eric@codebutler.com) with the details.
On Mac OS X, it gives an error saying: Run --fix-permissions first. Run with which command? and how?
I found the binary "firesheep-backend" in:
~/Library/Application Support/Firefox/Profiles/.default/extensions/firesheep@codebutler.com/platform/Darwin_x86-gcc3
./firesheep-backend --fix-permissions
sudo ./firesheep-backend --fix-permissions
EDIT:
After a bit of digging, I found out that running it with --fix-permissions really just chowns the binary to root then setuid's it. I don't see anything wrong with it on the surface, but I'll keep digging.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#68Earlier quoted context omitted.
SSL is bad for the environment because it requires far more server side hardware... Well, I'm only partially serious about the environment thing, the question is, how can internet companies make it commercially viable to use SSL for everything? The added hardware and power costs make each user way more expensive, possibly to the point where they may not actually be worth it. An alternative is to bind the user's sessi…
Require SSL on any request who's response sends a set-cookie http header. Leave it out for the non-sensitive request/responses.
You'd still be able to get the cookie when the client sends it bnack to the server on subsequent, non-SSL requests.
It's gotta be SSL all the time.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#69Nice . A solid demonstration to show next time your webmaster doesn't want to set up SSL everywhere. That said, the current cartel-like setup of certificate authorities (protection money and everything!) makes SSL annoying and expensive if you want the browser to not have a fit. Especially for small-scale projects. But there's really no excuse for larger sites.
You can get SSL certificates for free for one domain, and they work with all browsers (except Opera, IIRC). Also, you can use Perspectives for Firefox, which I think is much better than the current system.
Off topic, but re: Perspectives. It allows your browser to compare notes with other nodes on the Internet ('network notaries') to ensure that everyone is seeing the same cert for a given website.
Looks like a great idea, but how do they prevent the man-in-the-middle from impersonating a network notary?
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#70Earlier quoted context omitted.
You can get SSL certificates for free for one domain, and they work with all browsers (except Opera, IIRC). Also, you can use Perspectives for Firefox, which I think is much better than the current system.
I've had a bit of a look on Google, but I'm not 100% sure which provider you mean? Where can you get free SSL certificates that don't upset browsers?
Namecheap provides free ssl certificates for each domain you get through them.