Securing Your Website
Session Hijacking is Easy
Or, Why SSL certificates are generally more important than you think
A recent announcement at Toorcon in San Diego (Firefox extension makes social network ID spoofing trivial) makes it painfully obvious that logins to sessions in many sites are not enough to secure the interaction between site and user. A Firefox extension (Firesheep) makes it trivial for anyone in a public wifi setting to hijack logged-in sessions and to behave as that user. The keys here are three: a public wifi setting where all users will be sharing an IP identity, folks using internet sessions that involve logging in to identify themselves for a session, and no end to end encryption of the session (meaning that the user visits a mix of secure and insecure pages in a session).
Should you be concerned? That depends on whether the specifics of the case match your situation. Do you frequent websites like this in public wifi settings? Are you comfortable with the notion of your session being hijackable? If you have a corporate presence on some of these sites (like Facebook), you may want to be aware of how and where you access it.
