Public wifi insecure - even for secure sites?

-
The Register reports from the Black Hat Conference that even when surfing to an SSL-encrypted site using public wifi, if not all of the site enforces SSL, enough information can be intercepted to reveal Gmail and other personal websites:
The hack caught our attention because it shatters a common assumption concerning secure surfing on public access points. Up until now, we felt relatively safe using hotspots to access email as long as we logged in with an SSL session. Yes, we knew that any subsequent pages that were not appended by "https" in the address bar were were susceptible to snooping, but intruders still had no way to access the account itself.

Now we know better. Any session that isn't protected from start to finish by SSL is vulnerable to the hack. And because session IDs generated by most sites are valid for an indefinite period, that means intruders could silently access our accounts for years - even if we regularly change our passwords.
The Register suggests the Firefox extension CustomiseGoogle which, among other things, can mandate that rather than some Gmail traffic be encrypted, eliminating the information currently sent "in the clear".

Comments

Post a Comment

Popular posts from this blog

Remote Desktop Connection Manager - a boon for admins

-
I subscribe to a bunch of Microsoft blogs and one of them revealed a gem in the past month.  RDCMan, a tool which allows an admin to group together remote desktops, preset their username/password combos and connect to those groups with a right-click option, has been invaluable in my work lately which involves quickly jumping from server to server or from servers to a group of workstations.  The gorgeous thing about it is not merely a gallery of thumbnails of the connected sessions, but the ability to interact with the thumbnails with sufficiently accurate mouse clicks.  Heartily recommended. Here's the original post: Introducing Remote Desktop Connection Manager 2.2 (You had me at EHLO - the Microsoft Exchange Team blog)
Read more

Chirac gets it right on Lebanon troops?

-
When you have bloggers such as Far and Wide's Steve V and Sicilian Notes' Richard Waghorne , the former a raging critic of Israeli operations in Lebanon and the latter a largely uncritical supporter, agreeing on something you can't help feeling like the unlikely has happened - France is doing something right. They have both criticised France's reluctance to increase UNIFIL troop numbers beyond a fairly token 400, up from their current commitment of 200. France's reluctance is mirrored by the Germans who have offered naval anti-smuggling patrols and perhaps border security, the UK and Denmark who have also offered ships, the Italians who are ready to send 3,000 but not yet and the Irish who have earmarked 200 (which would bring them up to the legal maximum of about 850 overseas at any time due to the Liberia mission) but who are also holding back . The reason is that which I posted on some days ago (albeit having taken a second swing at it) - Resolution 1701 does...
Read more

"Your request could not be completed. Please try again in a few minutes."

-
When setting automatic replies (Out of Office) via Exchange 2013 OWA on behalf of another user, the message in the title can be displayed when saving the text. If you look at the System Event Log on the Exchange Server, you may see the following event ID 4: Current user: '" (domain)/(OU)/(OU)/(administrator) " on behalf of " (domain)/(OU)/(OU)/(User) "' Request for URL ( long URL follows ) failed with the following error: Microsoft.Exchange.Management.ControlPanel.RegionalSettingsNotConfiguredException: We couldn't process the request because the user ' (domain)/(OU)/(OU)/(User) ' hasn't signed in to Outlook Web App and selected a language and a time zone. Ask the user to do this, or, if you are a member of the built-in Organization Management or Help Desk role group, you can use Window PowerShell to select a language and time zone for them. Cancel the Automatic Replies dialog and switch to Settings, which will display a Time Zone selecti...
Read more