Re:Firesheep: Easy HTTP session hijacking from within Firefox
by GVRV on Monday October 25, 2010 @12:36AM
(#1828562)
Definitely, I guess as a uni student, I'm worried about the majority of non-technical students who are going to have their sessions hacked and have no clue what hit them and cannot setup proxies/tunnels.
I'm not saying this isn't the site's fault. They definitely need a wake-up call.
Re:Firesheep: Easy HTTP session hijacking from within Firefox
by mike-cardwell on Monday October 25, 2010 @05:51AM
(#1829168)
This was already happening on a massive scale before this new app was released... I honestly don't think it will increase the number of attacks by all that much. It's brilliant as a tool for spreading the word though.
Re:Firesheep: Easy HTTP session hijacking from within Firefox
by silvermoonstar3 on Monday October 25, 2010 @10:30AM
(#1829913)
It was happening on a massive scale, but now a huge amount of really lazy people who didn't bother to do this before are. It had 3,000 downloads after 2 hours of release. The thing is, most universities have protection set up. It seems Cisco NAC is actually good for something. I never thought I'd say that. The extension certainly doesn't work on my campus.
How else are we going to convince people to secure their sites and protect their users? People have been presenting on this issue for years (Ferret & Hamster, Blackhat 2007) and companies haven't responded/cared. It's possible to solve this problem (Gmail is all HTTPS, and done correctly, Amazon has a tiered authentication system that properly uses SSL for important things, Wordpress does SSL right for accessing their admin interface) - companies need to step up and address the issue.