Firesheep - Otimanje sesija iz Firefox-a

[Ivan]

http://codebutler.com/firesheep

When logging into a website you usually start by submitting your username and password. The server then checks to see if an account matching this information exists and if so, replies back to you with a "cookie" which is used by your browser for all subsequent requests.

...

When logging into a website you usually start by submitting your username and password. The server then checks to see if an account matching this information exists and if so, replies back to you with a "cookie" which is used by your browser for all subsequent requests.

...

[squirll]

24 oct 2010.. still active?

[Ivan]

Koncept je zanimljiv, addon za browser koji snifuje saobracaj na mrezi i automatizovano preuzima kolacice ... vise: http://www.schneier.com/blog/archive...firesheep.html

[noviKorisnik]

OK, vidim da su tamo na primeru navedeni facebook, twitter i flick. Drugi primer - na last.fm login uvek ide preko https - da li je moguće da su njihovi korisnici na taj način zaštićeni od preuzimanja kolačića, ili bi za obezbeđenje toga morala cela sesija da se odvija u sigurnom okruženju?

[Enkod]

Ako ste dovoljno paranoični eevo reešenja



džaba mu posle sesija, kad je istekla...

[35-68]

https://addons.mozilla.org/en-US/fir...don/force-tls/

Force-TLS allows web sites to tell Firefox that they should be served via HTTPS in the future; this helps secure you from accidentally negotiating an insecure session with certain sites. Force-TLS is also compatible with Strict Transport Security.

Izvor:
http://techcrunch.com/2010/10/25/firesheep/
http://techcrunch.com/2010/10/24/fir...counts-easily/

[ivanhoe]

ovo je prilicno matora prica... ako si na nesigurnoj mrezi resenje je u ssh tunelu... ovde ima i automatizovano resenje za to, mada je i obican ssh ili putty dovoljan samo treba rucno konfigurisati proxy

[Ivan]

^ prestize me ivanhoe

Mac OS X: http://chetansurpur.com/projects/sidestep/