Hacker News Reader

Comment by zzzeek | Hacker News Reader

once you login and the fact that you're logged in is passed around via a cookie, unless the entire interaction with the website is over HTTPS, the session can be hijacked in any wifi coffeehouse, rendering the limited usage of HTTPS mostly pointless.

View on HN

The point is to prevent your actual password from being sent in the clear. Yes your session could still be hijacked, but most websites will at least require you to re-enter your password (over SSL) to change your key profile attributes or password, meaning the most someone can do with a hijacked session is vandalize the site from your account. If they have your password via sniffing, they can instantly do a whole lot more, especially if you use the same password everywhere, regardless of the merits of doing that.

I'll probably get slammed for this, but they do accept OpenID. Though that does nothing for session-jacking.

most websites will at least require you to re-enter your password (over SSL) to change your key profile attributes or password

While that is the case for most sites, HN doesn't require you to enter your current password when changing your password (or any other information for that matter).

You can hijack it in unprotected WiFi easily (e.g. firesheep), but even if it's protected, an attacker can use ARP poisoning to route all traffic to the attacker, and thus steal the sessions (and firesheep should still work in this case).

Are most/all common WiFi access points vulnerable to ARP poisoning?

As far as I know, all networks over a shared medium are vulnerable to ARP poisoning.

So in the old days, that was networks using hubs (instead of switches), these days it's wireless networks.

My understanding of the latest (WPA2) WiFi security is that each client creates a private channel with the access point – so it's totally up to the access point whether to trust, or route, anything any client says. That would suggest resistance to ARP poisoning is possible, at least. But I could be wrong, hence the question.

ARP poisoning is an inherent problem with the design of IP. There is no real defence against it, on any network that uses IP, regardless of what is running on the link layer (ethernet or any other 802.x protocol)

Just keep it under your hat lest someone put it into a firefox extension.

Reply on news.ycombinator.com