News for hackers. Stuff that matters.

A comment on Firesheep, a day later. Parent comment

Re:Firesheep, a day later by pornel on Tuesday October 26, 2010 @03:11PM (#1835577)
If you used cookies with HTTP-only and secure flags, then cookies alone should be safe, but the site wouldn't.

Someone could sniff login forms via injected scripts (XSS = game over) and modify page's content via unprotected CSS and images (which aids phishing, clickjacking).

[ Parent | on HN ]
Re:Firesheep, a day later by grandalf on Tuesday October 26, 2010 @03:31PM (#1835688)
ahh ok, that's true. Hadn't thought of that. Is there a caching solution that supports https?
[ Parent | on HN ]