User: Password:
|
|
Subscribe / Log in / New account

Gathering session cookies with Firesheep

Gathering session cookies with Firesheep

Posted Nov 5, 2010 5:01 UTC (Fri) by foom (subscriber, #14868)
In reply to: Gathering session cookies with Firesheep by Simetrical
Parent article: Gathering session cookies with Firesheep

It sure would be nice if RFC 2817 actually was a thing. Then http:// urls could be opportunistically encrypted without cert checking and without warning on use of unencrypted or unauthenticated connections.

That would be a pure increase in security, without degrading the security or MITM protection of the https:// url scheme.


(Log in to post comments)

Gathering session cookies with Firesheep

Posted Nov 5, 2010 16:45 UTC (Fri) by Simetrical (guest, #53439) [Link]

What attack does this prevent? Using more encryption doesn't help you if it doesn't prevent real-world attacks.

Gathering session cookies with Firesheep

Posted Nov 5, 2010 18:49 UTC (Fri) by foom (subscriber, #14868) [Link]

Uh, it protects against all forms of passive snooping of your network links. That's a huge increase in practical security. Not only is an active attack frequently harder to achieve, it also risks detection by the victims.

If everyone's "insecure" HTTP sessions were being encrypted that also makes widespread untargeted monitoring by e.g. a spy agency less feasible. You'd have to put your sniffer in the middle of things, and risk detection. (which I'm sure they do sometimes, but it has to be targeted...) Currently, someone could be sniffing the whole internet and nobody would have any way of telling.

Gathering session cookies with Firesheep

Posted Nov 5, 2010 20:40 UTC (Fri) by Simetrical (guest, #53439) [Link]

Granted. I think tcpcrypt.org is a much better way to approach this than Upgrade headers, though.


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds