up vote -1 down vote favorite
share [g+] share [fb]

Possible Duplicate:
On unencrypted public wifi, what kind of real danger am I in?

Looking for info about having session cookies captured when connected to unencrypted wifi.

What can be done with them, etc?

Please give info on the question and avoid responses like "use vpn" or "don't connect to unencrypted wifi".

Thanks.

Update: Edited for better scope definition.

Update2: For future searchers, I found these very interesting articles. They have good info on the subject. http://blogs.computerworld.com/17338/some_thoughts_on_blacksheep_and_firesheep

http://www.pcworld.com/businesscenter/article/210028/secure_your_pc_and_website_from_firesheep_session_hijacking.html

link|improve this question
95% accept rate
1  
Please don't make it a habit to put multiple questions into a single question. This is a Q&A sites, not Qs&A ;-) (If the title cannot summarize your question, then the question is too broad, if you'd ask me.) – Arjan Dec 7 '10 at 17:28
You won't give up, possible duplicate of your other post...superuser.com/questions/218771/… – Moab Dec 7 '10 at 17:53
feedback

closed as exact duplicate by Moab, BloodPhilia, Diago Dec 9 '10 at 8:11

This question covers exactly the same ground as earlier questions on this topic; its answers may be merged with another identical question. See the FAQ for guidance on how to improve it.

4 Answers

up vote 2 down vote

1) Unencrypted wifi typically means an "open" connection such as what is used in Mcdonalds and many locations. When Wifi is open, typically, it is possible for everyone to see what everyone else does. When you login to websites, the website remembers you typically by saving a cookie on your machine.

So, capturing the session cookie basically means stealing the cookie and putting it in to an active session elsewhere to trick the server in to thinking that you are the person who logged in.

2) Ins and outs? :S - well, I think I covered it in the first part - Unsecure wifi is convenient, but by its nature, it is unsecure.

You say filter out answers about use VPN, but that is honestly the solution - an encrypted tunnel to a trusted network. Many wifi hotspots fully support VPN clients and even give you configuation files for free (example - BT Openzone VPN client for the UK).

WPA2 based networks do a better job at isolating connections from each other, but it still has it's problems and is hackable by someone who knows what they are doing.

The only truly (IMHO) secure option is certificate based wifi networks, but other than in large enterprises with the infrastructure to support it, you just don't see it every day.

link|improve this answer
Thanks Wil. Yes, I know VPN is the best answer (the problem is that buying a VPN server to sit at home is beyond my current means) and I didn't want the thread to settle on that point since I already know that I'm trying to get an accurate picture of the risks of life without VPN. – CChriss Dec 7 '10 at 21:04
@CChriss - as I said, many hotspots give you a VPN for free if you take a look - Also, many routers support (or support can be added) for VPN server free. – William Hilsum Dec 7 '10 at 21:05
What do you mean by, "many hotspots give you a VPN for free"? (Your link to BT Openzone doesn't work for me.) Are you saying the business offers a VPN to their internet connection (protection from other computers on their wifi)? I have never seen that. I know my router (Cisco WRT54G2) allows VPN passthrough, but it isn't a server. I haven't ever looked closely at 3rd party firmware for it. Some might offer VPN server functionality. Would they also handle when my home IP address changes? That can be a show stopper. – CChriss Dec 7 '10 at 21:17
If the router doesn't offer directly, you can use a combination of Dyndns or similar to dynamically create vpn.yourdomain.com - as for the many provide bit, sorry, wrong link :S - I mean that many nationwide WIFI providers do this or something similar. The link for BT is btopenzone.com/help/security/vpn-software.jsp . – William Hilsum Dec 8 '10 at 0:28
feedback
up vote 0 down vote

To answer your second question, a solution can be a proxy server that uses SSL.

Another solution is a Firefox plugin called HTTPS Everywhere that attempts to force SSL connections.

If you're not looking to change traffic, you could try using Blacksheep. It's a plugin that detects HTTP session cookie capturing, but doesn't prevent it.

link|improve this answer
Thanks. I'll check out HTTPS Everywhere. I was reading about Blacksheep and it is interesting. My thought is that it might be best not to rely on it because, wouldn't many people who are actually capturing data be aware of the existence of Blacksheep and take measures to hide from it? I'm guessing there would be ways to hide from it since there's always a battle between offense and defense. – CChriss Dec 7 '10 at 19:30
Well, you make a good point. Looking at it from a security standpoint, you'll never be totally secure. You just have to figure out that sweet spot where there's an easy way to set something up that provides enough security that no one wants to bother :P I use a proxy server setup on a VPS, and I find that even though it's $15/month, I can use it for a Minecraft server as well :) So sometimes you can increase security as well as get something to play with. – CamronBute Dec 7 '10 at 19:54
feedback
up vote 0 down vote

Rent-a-VPN. Seriously. Your profile doesn't say where you are, but in the US there are a few subscription VPN services that will do exactly what you need without your having to deploy your own server. PublicVPN is one I'm familiar with and a happy customer of. $7/month, month-at-a-time, and no requirement to renew.

link|improve this answer
feedback
up vote 0 down vote

Another option would be to use the good-ol' SOCKS + ssh trick. (Hopefully nobody will spam that page again like it was when I found it from google -- there was some wierd div obscuring the actual content, but I fixed it by getting an account on that wiki, appending ?action=history to the URL, going to the previous revision, clicking "edit", and saving that old version as a new version.)

link|improve this answer
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.