[kwlug-disc] Firesheep: Open WiFi cookie stealing for the masses ...

[Lori Paniak]

On Tue, 2010-10-26 at 17:26 -0400, Chris Frey wrote:
> On Tue, Oct 26, 2010 at 05:09:49PM -0400, Khalid Baheyeldin wrote:
> > I am no expert on wireless encryption, but I think enabling WPA with a
> > weak password is enough to protect against site login hijacking.
> 
> Neither am I, unfortunately.  Does WPA2 turn wireless behaviour into
> a switch based network vs. a hub based network?  i.e.  If you can
> still use tcpdump to see other people's network activity after you've
> connected using the public password, then things haven't gotten
> much more secure.
> 
> - Chris
> 


Good question.  Since I'm not an expert either, I did a quick look on
the interwebs. The conclusion is that if you know the passphrase and you
capture the initial handshake of a WPA session, then you have access to
the entire communication stream.  In a coffee-shop setting, I believe
these conditions would be easy to fulfill. 

With a VPN link to an external (wired) server, it should be
straightforward to have all traffic routed over the tunnel.  Of course
the network performance hit is often substantial.  

Really, the architecturally sound method of solving this networking
problem is for web sites to use SSL for sensitive communications.  I
mean it's not like https is new tech.  What have people been waiting
for?  This?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: This is a digitally signed message part
URL: <http://kwlug.org/pipermail/kwlug-disc_kwlug.org/attachments/20101026/307d47d0/attachment.sig>