Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firesheep: Easy HTTP session hijacking from within Firefox

codebutler.com

Post reply on HN
Print view View original

91–100 of 356 posts

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#91

Post by jberryman »

Groxx wrote: post #13

Nice . A solid demonstration to show next time your webmaster doesn't want to set up SSL everywhere. That said, the current cartel-like setup of certificate authorities (protection money and everything!) makes SSL annoying and expensive if you want the browser to not have a fit. Especially for small-scale projects. But there's really no excuse for larger sites.

Startcom offers free no-BS certificate signing, and their CA is on most modern browsers, I believe. I think they could be suitable for small scale projects.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#93

Post by phamilton »

chrisbroadfoot wrote: post #82

Has anyone checked the source code to check that the passwords aren't sent to the author's website? :)

Passwords are not a part of this... It's the session cookie, which is an entirely different matter. It's unique to the login process, so one compromised account isn't able to lead to compromising other websites. It's also time sensitive (generally) and so that hijacked cookie will expire. If he were collecting all this information, he wouldn't be able to do much with it.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#94

Post by xorglorb »

gilaniali wrote: post #76
xorglorb wrote: post #67

Earlier quoted context omitted.

I found the binary "firesheep-backend" in: ~/Library/Application Support/Firefox/Profiles/ .default/extensions/firesheep@codebutler.com/platform/Darwin_x86-gcc3 I ran both: ./firesheep-backend --fix-permissions and sudo ./firesheep-backend --fix-permissions and it still asks me to run it with "--fix-permissions". I guess it's time to go digging around in the source to try and find out what it wants me to do. EDIT: Af…

There is an another firesheep-backend at /firesheep-backend.dSYM/Contents/Resources/DWARF inside the Darwin folder. However this one wont run using ./ Any ideas?

I believe that it is a file containing debug info, not an actual program, so you can't run it.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#95

Post by cdine »

flexterra wrote: post #89

Here is a simple tutorial on how to set up an SSH Tunnel for Mac OS X http://bit.ly/cffjOY This way all your communication is encrypted

I love SSH tunnels, but in regards to this particular problem, it really just pushes the problem off to wherever you ssh tunnel terminates. Do you trust you server operator? ISP? This is addressed in our presentation, here (VPN's are essentially doing the same thing): http://codebutler.github.com/firesheep/tc12/#20

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#96

Post by cdine »

GVRV wrote: post #88
chaosmachine wrote: post #2

"Double-click on someone, and you're instantly logged in as them." Ouch. I think it's time to set up that VPN I've been putting off...

Am I the only one who thinks this is spoon feeding the script kiddies to cause mayhem?

Well, hopefully it will then convince companies to properly secure their websites and actually protect users.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#97

Post by chrisbroadfoot »

phamilton wrote: post #93
chrisbroadfoot wrote: post #82

Has anyone checked the source code to check that the passwords aren't sent to the author's website? :)

Passwords are not a part of this... It's the session cookie, which is an entirely different matter. It's unique to the login process, so one compromised account isn't able to lead to compromising other websites. It's also time sensitive (generally) and so that hijacked cookie will expire. If he were collecting all this information, he wouldn't be able to do much with it.

Just because the user interface only exposes cookies, doesn't mean that passwords aren't captured and sent somewhere.

It's very possible, given that the extension seemingly captures HTTP requests/responses. If passwords are sent or received in plaintext, then they can be captured.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#98

Post by chrisbroadfoot »

jorgem wrote: post #87
kijinbear wrote: post #61

Be careful when trying this out. You could be breaking a law or two...

Also don't web-mail your friends to tell them about the new accounts you just broke into :) At least not on that open wireless connection.

Good thing GMail has SSL enabled by default ;)

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#99

Post by GVRV »

cdine wrote: post #96
GVRV wrote: post #88

Earlier quoted context omitted.

Am I the only one who thinks this is spoon feeding the script kiddies to cause mayhem?

Well, hopefully it will then convince companies to properly secure their websites and actually protect users.

Agreed, but I still think giving someone else full control is a bit too much. It's not the user's fault (most don't even know this is happening) and they're likely to be the victims here.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#100

Post by EricButler »

bluesmoon wrote: post #32
Groxx wrote: post #13

Nice . A solid demonstration to show next time your webmaster doesn't want to set up SSL everywhere. That said, the current cartel-like setup of certificate authorities (protection money and everything!) makes SSL annoying and expensive if you want the browser to not have a fit. Especially for small-scale projects. But there's really no excuse for larger sites.

SSL is bad for the environment because it requires far more server side hardware... Well, I'm only partially serious about the environment thing, the question is, how can internet companies make it commercially viable to use SSL for everything? The added hardware and power costs make each user way more expensive, possibly to the point where they may not actually be worth it. An alternative is to bind the user's sessi…

When Gmail switched on SSL for everyone earlier this year they added "no additional machines" (http://unblog.pidster.com/imperialviolet-overclocking-ssl).

Regarding IPs, there's a bigger issue here. People are used to being able to shut their laptop at home and open it back up at work without having to re-authenticate all their browser tabs. If you filter by IP this breaks. SSL requires no changes to user behavior.

Post reply on HN