用 FireSheep 劫持 Facebook；最好的预防措施是什么？它是如何发挥作用的？
关于此安全问题：
“只要用户登录到站点，并且没有重定向到 SSL/TLS/HTTPS 连接，会话 cookie 就容易受到攻击”，这句话是真的吗？
保护 Facebook 凭据的最佳解决方案是什么？它是如何工作的？
有什么方法可以实现安全会话并且不使用 SSL/TLS？换句话说，有什么办法可以让一台机器上的cookie不能在另一台机器上重播吗？
最后一个问题之所以重要，是因为 Google AdSense 不支持 SSL/TLS，因此将迫使设计者公开所有 cookie。这将反过来影响每个依赖 AdSense 的网站
Regarding this security issue: http://techcrunch.com/2010/10/24/firesheep-in-wolves-clothing-app-lets-you-hack-into-twitter-facebook-accounts-easily/
Is it true to say "any time a user logs into a site, and isn't redirected to SSL/TLS/HTTPS connection, that the session cookies are vulnerable"?
What is the best solution to protect a Facebook credentials, and how does it work?
Is there any way to have a secure session and not have SSL/TLS? In other words, is there any way to make it so that cookies on one machine can't be replayed on another?
The reason the last question is important is because Google AdSense does not support SSL/TLS and therefore will force the designer to expose all cookies. This will in turn affect every site that relies on AdSense
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
问题在于 cookie，如果您没有 SSL/TLS，则在网络上以明文形式发送。
监听 TCP/IP 流量的任何人都可以读取未加密的数据，并且可以读取您的 cookie。
当你拥有它们后，你可以将其复制到你自己的计算机上，它就会工作......
你需要 SSL/TLS ！
The problem is the cookies and send in clear on the network if you don't have SSL/TLS.
Anyone listening to the TCP/IP traffic can read unencrypted data and can read you cookies.
When you have them you can copy it on your own computer and it will work...
You need SSL/TLS !
当您公开（未加密）传输数据时，无法保护您的信息，尤其是不使用 cookie，cookie 是一种众所周知且广泛使用的用于存储不敏感用户信息的协议。您可以尝试一些技巧和技巧来断言只有获得 cookie 的人才能使用它，但这并不是 cookie 的设计目的。 Cookie 不是安全功能！
如果您想要隐私，请使用加密。就这么简单。 SSL 证书很便宜（每年低至 10 美元）。如果需要安全和隐私，则没有理由不使用 SSL。
When you are transmitting data in the open (unencrypted) there is NO WAY to protect your information, especially not using a cookie which is a well-known and widely used protocol for storing insensitive user information. You may try tricks and hacks to assert that only the person to whom the cookie was issued is the one who can use it, but that is not what cookies were designed for. COOKIES ARE NOT A SECURITY FEATURE!
If you want privacy, use encryption. It's as simple as that. SSL certs are cheap (as low as $10 per year). If security and privacy are a requirement, there is no excuse not to use SSL.
对于您自己的网站，您可以将 Cookie 设计得更安全： http://jaspan.com/improved_persistent_login_cookie_best_practice
但是因为Facebook 还没有这样做，唯一的选择是使用 SSL。
For your own sites, you can design cookies to be more secure: http://jaspan.com/improved_persistent_login_cookie_best_practice
But because Facebook hasn't done this, the only option if to use SSL.