Bringing in the Sheep: the FireSheep firestorm

Lonnie Olson lists at kittypee.com
Thu Nov 4 14:23:14 MDT 2010


On Thu, Nov 4, 2010 at 2:04 PM, Michael Torrie <torriem at gmail.com> wrote:
> So this is basically an old-style attack, such as was common before the
> days of internet switches.  This is made even easier by the fact that
> most wirelss routers are not only shared broadcast medium (like a hub)
> but also natted through a common IP address, making firesheep's use of
> the session indistinguishable from the victim's.  And of course you have
> to use a non-encrypted wireless connection, as WPA connections don't
> allow clients to see eachother's traffic.
>

Exactly, very old-style attack.  Firesheep just makes this attack
super dead simple.

It was created to popularize the problem, in order to convince website
owners in the importance of SSL.

As far as SSL performance goes, It's generally not a big enough
performance hit to add this additional risk.


More information about the PLUG mailing list