Recent Story Comments

Yes, session hijacking is

andrew — Mon, 09 Mar 2009 01:15:14 +0000

Yes, session hijacking is still a problem. I'd hoped to write an updated version which would also force subsequent page loads to occur over SSL, but if there's concerns about d.o performance then perhaps I'll hold off. Perhaps the next conference WiFi will use WPA to at least make it more difficult for traffic sniffing to occur.

Thanks for your comments!

Alas, this isn't going to

christefano — Sun, 08 Mar 2009 04:33:49 +0000

Alas, this isn't going to work. It's a different approach from my own (I wrote a Firefox extension last year) and an interesting one at that, but Heine has already written the definitive post on this, Security theater #1 - Using SSL for login.

Still unsecure

Mikkel Høgh — Sat, 07 Mar 2009 09:46:53 +0000

Well, SSL is a good thing, but when you only use it for the actual login, you have actually accomplished very little, since a would be eavesdropper can still just grab your session cookie from the first regular HTTP request and use that to steal your account.

So although this approach will protect the actual password, it doesn't help session hijacking. For that, we will have to serve up every single non-anonymous pageview via SSL. And that's currently not feasible.