Search Results

Search found 4 results on 1 pages for 'firesheep'.

Page 1/1 | 1 

• Mitigating the 'firesheep' attack at the network layer?

  - by pobk

  What are the sysadmin's thoughts on mitigating the 'firesheep' attack for servers they manage? Firesheep is a new firefox extension that allows anyone who installs it to sidejack session it can discover. It does it's discovery by sniffing packets on the network and looking for session cookies from known sites. It is relatively easy to write plugins for the extension to listen for cookies from additional sites. From a systems/network perspective, we've discussed the possibility of encrypting the whole site, but this introduces additional load on servers and screws with site-indexing, assets and general performance. One option we've investigated is to use our firewalls to do SSL Offload, but as I mentioned earlier, this would require all of the site to be encrypted. What's the general thoughts on protecting against this attack vector? I've asked a similar question on StackOverflow, however, it would be interesting to see what the systems engineers thought.

  Read the article

• List of eCommerce sites that use end-to-end SSL?

  - by Jon Schneider

  My development team is considering implementing an eCommerce site using end-to-end SSL -- that is, every page on the site is accessed via an https:// URL -- rather than the more traditional "mixed mode" where most pages are accessed via http:// and only "secure" pages such as login and credit card entry are redirected to https://. Pros of doing such a "pure SSL" approach include avoidance of some session-hijacking attacks such as Firesheep; cons include performance considerations. My question is: Is anyone aware of a list of eCommerce websites (especially USA-based sites), or even specific websites, that use this end-to-end SSL approach? I'm especially interested in "regular" eCommerce sites rather than banks or other "financial" sites.

  Read the article

• Ad networks that will serve via HTTPS?

  - by Dogweather

  I've built a website with 160K page views per month that serves every page over HTTPS. The recent FireSheep news will probably increase the adoption of "HTTPS everywhere" but it's been very hard to find ad networks and affiliates that will serve their content via HTTPS. I don't want to use these because I don't want my visitors to get "broken security" notification from their browsers (and of course, relevant ads would be a leak of private information). I'm tired of spending a ton of time signing up with ad networks and affiliates only to find out down the road that they don't support HTTPS (e.g. AdSense). Can anyone suggest any options or provide a pointer to a list of these somewhere?

  Read the article

• Wireshark Not Displaying Packets From Other Network Devices, Even in Promisc Mode

  - by eb80

  System Setup: 1. MacBook running Mountain Lion. 2. Wireshark installed and capturing packets (I have "capture all in promiscuous mode" checked) 3. I filter out all packets with my source and destination IP using the following filter ("ip.dst != 192.168.1.104 && ip.src != 192.168.1.104") 4. On the same network as the MacBook, I use an Android device (connecting via WiFi) to make HTTP requests. Expected Results: 1. Wireshark running on the MacBook sees the HTTP request from the Android device. Actual Results: 1. I only see SSDP broadcasts from 192.168.1.1 Question: What do I need to do so that Wireshark, like Firesheep, can see and use the packets (particularly HTTP) from other network devices on the same network?

  Read the article

1