ASP.NET 会员资格是否受到 Firesheep 的保护？
我的印象是 ASP.NET Membership 默认加密其 cookie。
假设 ASP.NET 成员身份可以防止会话劫持（ala Firesheep）是否相对安全？
I have the impression that ASP.NET Membership encrypts its cookie by default.
Is it relatively safe to assume that ASP.NET Membership protects against session hijacking (ala Firesheep)?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
ASP.NET 成员资格使用与任何其他站点完全相同的机制，并且绝对容易受到 Firesheep 攻击。 Cookie 本身无法以防止其被劫持的方式进行加密。与服务器的所有通信都必须使用 SSL 或 WEP 无线加密进行加密，以防止会话劫持。
ASP.NET membership uses the exact same mechanism as any other site and is absolutely vulnerable to Firesheep attack. The cookie itself cannot be encrypted in a way that keeps it from being hijacked. All communication with the server must be encrypted to protect from session hijacking, using SSL or WEP wireless encryption.
Cookie 已加密，但这并不能阻止获取 Cookie 本身的人冒充您的身份。
The cookie is encrypted, but that doesn't stop someone who obtains the cookie itself from acting as you.
仅当整个会话都在 HTTPS 上时。
Firesheep 不关心 cookie 的内容；它所需要做的就是在攻击者的浏览器中复制 cookie。
只要 cookie 以明文形式发送（而不是 HTTPS 或 WPA），您仍然容易受到攻击。
Only if the entire session is on HTTPS.
Firesheep doesn't care about the contents of the cookie; all it needs to do is duplicate the cookie in the attacker's browser.
As long as the cookie is sent in clear text (as opposed to HTTPS or WPA), you're still vulnerable.