User: Password:
|
|
Subscribe / Log in / New account

Gathering session cookies with Firesheep

Gathering session cookies with Firesheep

Posted Nov 5, 2010 19:23 UTC (Fri) by foom (subscriber, #14868)
In reply to: Gathering session cookies with Firesheep by paulj
Parent article: Gathering session cookies with Firesheep

You don't want to make https://mybank.com allow self-signed certs without warning, because the "s" on the end means both "try to encrypt" and "I expect this url to be MITM-free". What was a secure bookmark to a MITM-protected url would no longer be MITM-protected at all. That's a decrease in security.

This is what RFC 2817 (not implemented by anyone) would be useful for.

The right thing to do is to leave https:// alone, but to add the ability to encrypt http:// transactions, without requiring that MITM-protection be present. If http:// urls could be automatically encrypted whenever both the client and server support it, that's a pure win. Even more so if all the popular servers were configured to have that work out of the box.


(Log in to post comments)

Gathering session cookies with Firesheep

Posted Nov 6, 2010 2:06 UTC (Sat) by paulj (subscriber, #341) [Link]

You're basically restating exactly my point, despite trying to disagree with me. ;)


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds