9 ms·

How To Protect Your Login Information From Firesheep

50 points by chegra 16y ago

po 16y ago
And while everyone should have learned by now that there’s always some privacy risk when interacting online, hopefully the installation of Force-TLS will at least put less of a damper on today’s stint at your local “free Wifi!” boasting cafe. For most people there is a huge gap between "can read everything I write" and "can gain full control/impersonate me". On the technology side, these two things are unfortunately coupled. It is way more than a privacy risk. If it were possible to pass the cookie on an encrypted channel but the content of the web page unencrypted this would match most people's idea of how it works. Unfortunately that's not the case.
- whakojacko 16y ago
  If it were possible to pass the cookie on an encrypted channel but the content of the web page unencrypted this would match most people's idea of how it works. Unfortunately that's not the case. Has there even been any attempt to standardize something like this? This problem certainly isn't a new one, so I would have guessed this had been looked into before
  - pornel 16y ago
    > Has there even been any attempt to standardize something like this? Yes. HTTP Digest authentication is an "encrypted cookie". The problem is that it only protects against passive sniffing. Attacker able to inject packets can bypass it (e.g. replace Digest with Basic auth.)
jazzyb 16y ago
However, ForceTLS will only work if the server supports HTTPS. IMO, a better solution is that of a SOCKS proxy as outlined in this comment: http://news.ycombinator.com/item?id=1828631 http://news.ycombinator.com/item?id=1828631 Using ssh as a SOCKS server has the added benefit of tunneling all traffic securely, not just that of Firefox.
- chaosmachine 16y ago
  I've been using a SOCKS proxy over SSH for a while now, but I find it very slow, especially when loading a page that requires a few dozen HTTP requests. So, today I set up a VPN using these instructions: http://library.linode.com/networking/vpn-services/openvpn-ubuntu-9.10-karmic http://library.linode.com/networking/vpn-services/openvpn-ub... Problem solved.
- pmjordan 16y ago
  SOCKS has no inherent encryption and is insecure as hell. Although there is an encrypted mode available in some servers, it's not supported by all clients, and it doesn't defend against MITM attacks, which limits its usefulness. (ever see a SOCKS client with a tickbox "only allow encrypted connections? didn't think so) SOCKS alone doesn't gain you any security advantage, it's SSH that does. Note that if you have a tun/tap driver installed on both endpoints, ssh can even operate as a full-on VPN (-w option), thus not requiring any client software support. None of the above (or OpenVPN) will work on a non-jailbroken iPhone/iPod/iPad, unfortunately. You'll need a pptp or IPSEC server for that. Also beware of apps which do use SSL to communicate but don't check certificates. You'd be surprised how many get this wrong. This leaves the connection wide open to MITM attacks. EDIT: objective arguments > downvoting
  - atleta 16y ago
    You didn't get it. SSH can be used for tunneling (encrypting) TCP connections between two machines and it can be set up so that the SSH client acts as a SOCKS proxy. Client apps connect to the SSH client, it tunnels the traffic trough the encrypted SSH connection to the other side where the SSH server decrypts it and connects to the target host. The traffic is thus encrypted between your machine and the SSH server, can't be sniffed from the air (unless the server is also connected to an insecure WIFI ;) ).
    - pmjordan 16y ago
      You didn't read my post: "SOCKS alone doesn't gain you any security advantage, it's SSH that does."
StavrosK 16y ago
Okay, I must have misunderstood something. At which point does Firesheep get your credentials? Really, the only case I am aware of is if you are on a wifi network, and I'm not sure if all the users on a secure network use the same encryption key. I haven't seen a hub in ages, so when you're on a LAN you shouldn't be getting any packets that weren't meant for you. When exactly does Firesheep work?
- chaosmachine 16y ago
  I'm not an expert on wifi security, but here is what I found while doing some research: "Wireshark can decrypt WEP and WPA/WPA2 in pre-shared (or personal) mode. WPA/WPA2 enterprise mode decryption is not yet supported." Since Wireshark and Firesheep both use WinPcap, I assume this applies to both. Also, while testing on an unsecured network, I found Firesheep was easily able to grab my HN session off my Android phone.
  - StavrosK 16y ago
    I think that only applies to being able to decrypt packets after you've acquired the key, I'm not sure if it applies here...
    - chaosmachine 16y ago
      Yes, you need the key to decrypt, but getting the key is not difficult for WEP [0], and only moderately difficult [1][2] for WPA PSK, if I understand correctly. [0] http://www.cyberciti.biz/tips/howto-crack-wirless-wep-104.html http://www.cyberciti.biz/tips/howto-crack-wirless-wep-104.ht... "The actual computation takes about 3 seconds" [1] http://www.renderlab.net/projects/WPA-tables/ http://www.renderlab.net/projects/WPA-tables/ "computed hash tables for the 1000 most common SSIDs against a million common passphrases" [2] http://securityandthe.net/2008/10/12/russian-researchers-achieve-100-fold-increase-in-wpa2-cracking-speed/ http://securityandthe.net/2008/10/12/russian-researchers-ach... "This means that a WPA or WPA2 key could be cracked in days or weeks instead of years."
      - 16y ago
mike4u2 16y ago
You can simply use "iPig" http://www.iopus.com/ipig/ http://www.iopus.com/ipig/
atleta 16y ago
What's so surprising about this? I don't get it. It's decades old news, unencrypted network traffic can be sniffed. And the solution is almost a decade old as well: use TOR (www.torproject.org) or JAP ( http://anon.inf.tu-dresden.de/index_en.html http://anon.inf.tu-dresden.de/index_en.html ) to hide your traffic from your local network operator. Be it your favorite dictator, government, employer, husband/wife, girlfriend/boyfriend or mother. Even if on a WPA encrypted network, the AP operator (or anyone between the AP and the internet provider) can steal your data. (Of course the internet provider could do this as well, they are just probably less of a problem than the next guy with firesheep or an open AP set up for logging your sessions and passwords.)

50 points by chegra 16y ago

po 16y ago

And while everyone should have learned by now that there’s always some privacy risk when interacting online, hopefully the installation of Force-TLS will at least put less of a damper on today’s stint at your local “free Wifi!” boasting cafe. For most people there is a huge gap between "can read everything I write" and "can gain full control/impersonate me". On the technology side, these two things are unfortunately coupled. It is way more than a privacy risk. If it were possible to pass the cookie on an encrypted channel but the content of the web page unencrypted this would match most people's idea of how it works. Unfortunately that's not the case.

whakojacko 16y ago
If it were possible to pass the cookie on an encrypted channel but the content of the web page unencrypted this would match most people's idea of how it works. Unfortunately that's not the case. Has there even been any attempt to standardize something like this? This problem certainly isn't a new one, so I would have guessed this had been looked into before
- pornel 16y ago
  > Has there even been any attempt to standardize something like this? Yes. HTTP Digest authentication is an "encrypted cookie". The problem is that it only protects against passive sniffing. Attacker able to inject packets can bypass it (e.g. replace Digest with Basic auth.)

jazzyb 16y ago

However, ForceTLS will only work if the server supports HTTPS. IMO, a better solution is that of a SOCKS proxy as outlined in this comment: http://news.ycombinator.com/item?id=1828631 http://news.ycombinator.com/item?id=1828631 Using ssh as a SOCKS server has the added benefit of tunneling all traffic securely, not just that of Firefox.

chaosmachine 16y ago
I've been using a SOCKS proxy over SSH for a while now, but I find it very slow, especially when loading a page that requires a few dozen HTTP requests. So, today I set up a VPN using these instructions: http://library.linode.com/networking/vpn-services/openvpn-ubuntu-9.10-karmic http://library.linode.com/networking/vpn-services/openvpn-ub... Problem solved.
pmjordan 16y ago
SOCKS has no inherent encryption and is insecure as hell. Although there is an encrypted mode available in some servers, it's not supported by all clients, and it doesn't defend against MITM attacks, which limits its usefulness. (ever see a SOCKS client with a tickbox "only allow encrypted connections? didn't think so) SOCKS alone doesn't gain you any security advantage, it's SSH that does. Note that if you have a tun/tap driver installed on both endpoints, ssh can even operate as a full-on VPN (-w option), thus not requiring any client software support. None of the above (or OpenVPN) will work on a non-jailbroken iPhone/iPod/iPad, unfortunately. You'll need a pptp or IPSEC server for that. Also beware of apps which do use SSL to communicate but don't check certificates. You'd be surprised how many get this wrong. This leaves the connection wide open to MITM attacks. EDIT: objective arguments > downvoting
- atleta 16y ago
  You didn't get it. SSH can be used for tunneling (encrypting) TCP connections between two machines and it can be set up so that the SSH client acts as a SOCKS proxy. Client apps connect to the SSH client, it tunnels the traffic trough the encrypted SSH connection to the other side where the SSH server decrypts it and connects to the target host. The traffic is thus encrypted between your machine and the SSH server, can't be sniffed from the air (unless the server is also connected to an insecure WIFI ;) ).
  - pmjordan 16y ago
    You didn't read my post: "SOCKS alone doesn't gain you any security advantage, it's SSH that does."

StavrosK 16y ago

Okay, I must have misunderstood something. At which point does Firesheep get your credentials? Really, the only case I am aware of is if you are on a wifi network, and I'm not sure if all the users on a secure network use the same encryption key. I haven't seen a hub in ages, so when you're on a LAN you shouldn't be getting any packets that weren't meant for you. When exactly does Firesheep work?

chaosmachine 16y ago
I'm not an expert on wifi security, but here is what I found while doing some research: "Wireshark can decrypt WEP and WPA/WPA2 in pre-shared (or personal) mode. WPA/WPA2 enterprise mode decryption is not yet supported." Since Wireshark and Firesheep both use WinPcap, I assume this applies to both. Also, while testing on an unsecured network, I found Firesheep was easily able to grab my HN session off my Android phone.
- StavrosK 16y ago
  I think that only applies to being able to decrypt packets after you've acquired the key, I'm not sure if it applies here...
  - chaosmachine 16y ago
    Yes, you need the key to decrypt, but getting the key is not difficult for WEP [0], and only moderately difficult [1][2] for WPA PSK, if I understand correctly. [0] http://www.cyberciti.biz/tips/howto-crack-wirless-wep-104.html http://www.cyberciti.biz/tips/howto-crack-wirless-wep-104.ht... "The actual computation takes about 3 seconds" [1] http://www.renderlab.net/projects/WPA-tables/ http://www.renderlab.net/projects/WPA-tables/ "computed hash tables for the 1000 most common SSIDs against a million common passphrases" [2] http://securityandthe.net/2008/10/12/russian-researchers-achieve-100-fold-increase-in-wpa2-cracking-speed/ http://securityandthe.net/2008/10/12/russian-researchers-ach... "This means that a WPA or WPA2 key could be cracked in days or weeks instead of years."
    - 16y ago

mike4u2 16y ago

You can simply use "iPig" http://www.iopus.com/ipig/ http://www.iopus.com/ipig/

atleta 16y ago

What's so surprising about this? I don't get it. It's decades old news, unencrypted network traffic can be sniffed. And the solution is almost a decade old as well: use TOR (www.torproject.org) or JAP ( http://anon.inf.tu-dresden.de/index_en.html http://anon.inf.tu-dresden.de/index_en.html ) to hide your traffic from your local network operator. Be it your favorite dictator, government, employer, husband/wife, girlfriend/boyfriend or mother. Even if on a WPA encrypted network, the AP operator (or anyone between the AP and the internet provider) can steal your data. (Of course the internet provider could do this as well, they are just probably less of a problem than the next guy with firesheep or an open AP set up for logging your sessions and passwords.)