Firesheep, a day later

Re:Firesheep, a day later by grandalf on Tuesday October 26, 2010 @12:50PM (#1834945)

Would a mixed (http + https) site with cookieless http traffic (from a different domain) be secure? Could something like this be included in the spec?

[ Parent | on HN ]

Re:Firesheep, a day later by pornel on Tuesday October 26, 2010 @03:11PM (#1835577)

If you used cookies with HTTP-only and secure flags, then cookies alone should be safe, but the site wouldn't.

Someone could sniff login forms via injected scripts (XSS = game over) and modify page's content via unprotected CSS and images (which aids phishing, clickjacking).

[ Parent | on HN ]

Re:Firesheep, a day later by grandalf on Tuesday October 26, 2010 @03:31PM (#1835688)

ahh ok, that's true. Hadn't thought of that. Is there a caching solution that supports https?

[ Parent | on HN ]