News for hackers. Stuff that matters.
Re:Firesheep: Easy HTTP session hijacking from within Firefox by bluesmoon on Sunday October 24, 2010 @10:06PM (#1828126)
vpn/ssh tunnel/encrypted wifi
Re:Firesheep: Easy HTTP session hijacking from within Firefox by chrisbroadfoot on Sunday October 24, 2010 @11:37PM (#1828406)
Encrypted WiFi won't stop clients on the network from sniffing your packets.

It will, however, stop unauthorised computers from sniffing any network data.

Re:Firesheep: Easy HTTP session hijacking from within Firefox by gojomo on Monday October 25, 2010 @12:58AM (#1828623)
I would have expected each wireless client, on an encrypted network, to negotiate its own key with the access point -- so you'd only see neighbors' traffic if the access point chose to rebroadcast it to you.

Are you sure that neither WEP nor WPA/WPA2 do it this way?

Re:Firesheep: Easy HTTP session hijacking from within Firefox by chrisbroadfoot on Monday October 25, 2010 @02:11AM (#1828767)
The encryption is between your client and the AP. Uaually everything after that is standard IP.
Re:Firesheep: Easy HTTP session hijacking from within Firefox by gojomo on Monday October 25, 2010 @02:30AM (#1828804)
That's what I thought -- enough to protect against fellow wireless sharers, but not the hosting establishment or path through their ISP to a website.
Re:Firesheep: Easy HTTP session hijacking from within Firefox by chrisbroadfoot on Monday October 25, 2010 @02:45AM (#1828837)
No, you misunderstood. It's enough to protect you against random people sniffing wireless packets. Not other people that are on your network.
Re:Firesheep: Easy HTTP session hijacking from within Firefox by gojomo on Monday October 25, 2010 @03:21AM (#1828911)
Your terminology "the network" or "your network" is still unclear; encryption to the AP could be unique per wireless network client, or not. If it is unique per client -- and it is my belief that recent standards, like WPA2 at least, provide this -- then casual passive eavesdropping by other wireless clients (as with the FireSheep tool) is thwarted. (And that's what most people are most concerned about.)

Are you suggesting that no generation of WEP or WPA protects against other authorized wireless users of the same AP, because they're "on your network"?

[rewritten completely to seek clarification]

Re:Firesheep: Easy HTTP session hijacking from within Firefox by bluesmoon on Monday November 01, 2010 @06:56PM (#1858566)
WPA enterprise allows a separate (changing) key for each user, typically what you get from an RSA token. Once it gets to the AP, it's then clear text (assuming HTTP) over the rest of the internet until it hits your (HTTP) service provider.

If you have control over the internet between the AP and your server, then you're safe. If you don't, then how safe you are depends on how much you can trust the owner of each router along the way. In general, you should be okay, except that every now and then you might end up on an untrusted router, and it's then game over.

Re:Firesheep: Easy HTTP session hijacking from within Firefox by barfoomoo on Monday October 25, 2010 @03:22AM (#1828913)
Sorry, did not follow this part - "Not other people that are on your network.". Care to elaborate?