Comments on: How To Use SSL To Secure Your Rails App Against FireSheep And Other Evils http://www.kalzumeus.com/2010/10/25/how-to-use-ssl-to-secure-your-rails-app-against-firesheep-and-other-evils/?utm_source=rss&utm_medium=rss&utm_campaign=how-to-use-ssl-to-secure-your-rails-app-against-firesheep-and-other-evils Patrick McKenzie (patio11) blogs on software development, marketing, and general business topics Thu, 14 Jan 2016 20:48:09 +0000 hourly 1 http://wordpress.org/?v=4.1.7 By: How can we tell whether a webpage is secure? | WOPLL http://www.kalzumeus.com/2010/10/25/how-to-use-ssl-to-secure-your-rails-app-against-firesheep-and-other-evils/#comment-3568 Tue, 23 Nov 2010 18:09:59 +0000 http://www.kalzumeus.com/?p=1063#comment-3568 […] How To Use SSL To Secure Your Rails App Against FireSheep And Other Evils (kalzumeus.com) […]

]]> By: [delicious | grep links | blogger] for 2010-10-30 at The Standard Output http://www.kalzumeus.com/2010/10/25/how-to-use-ssl-to-secure-your-rails-app-against-firesheep-and-other-evils/#comment-3567 Sun, 14 Nov 2010 05:24:52 +0000 http://www.kalzumeus.com/?p=1063#comment-3567 […] el-get Pymacs Recipes Mechanical Keyboard Guide – Overclock.net – Overclocking.net How To Use SSL To Secure Your Rails App Against FireSheep And Other Evils: MicroISV on a Shoestring the creative internet (106 things) Reading X509 Certificates from remote machines INI Files Meet […]

]]> By: Delicious Bookmarks for November 12th from 03:01 to 03:06 « Lâmôlabs http://www.kalzumeus.com/2010/10/25/how-to-use-ssl-to-secure-your-rails-app-against-firesheep-and-other-evils/#comment-3566 Fri, 12 Nov 2010 10:02:57 +0000 http://www.kalzumeus.com/?p=1063#comment-3566 […] How To Use SSL To Secure Your Rails App Against FireSheep And Other Evils: MicroISV on a Shoestring – November 12th ( tags: ssl rails security nginx ruby firesheep programming webdev howto secure ror app webapp guide tips tricks tutorial ) […]

]]> By: Patrick http://www.kalzumeus.com/2010/10/25/how-to-use-ssl-to-secure-your-rails-app-against-firesheep-and-other-evils/#comment-3565 Mon, 08 Nov 2010 09:40:00 +0000 http://www.kalzumeus.com/?p=1063#comment-3565 All of that stuff is inside a Rails action, Chris. Most of the headers go directly to the client. The X-Accel-Redirect one tells the Nginx that is in front of your mongrel “grab this file off the disk and give it to them, without tying up my mongrel during the potentially long download process”

]]> By: Chris http://www.kalzumeus.com/2010/10/25/how-to-use-ssl-to-secure-your-rails-app-against-firesheep-and-other-evils/#comment-3564 Sun, 07 Nov 2010 21:00:21 +0000 http://www.kalzumeus.com/?p=1063#comment-3564 In the code snippet where you list all the headers you had to set specifically for IE, you don’t say in what file you put those. It looks like it’s in a Rails action, since you’re saying render :nothing => true, or possibly a before_filter, but then you mention using X-Accel-Redirect in Nginx to serve the files directly. Can you please clarify? I’d like to implement this.

Thanks!

]]> By: Chaitanya Gupta http://www.kalzumeus.com/2010/10/25/how-to-use-ssl-to-secure-your-rails-app-against-firesheep-and-other-evils/#comment-3563 Tue, 02 Nov 2010 15:22:55 +0000 http://www.kalzumeus.com/?p=1063#comment-3563 That’s great to hear! I thought that the switch to HTTPS might have been slightly bandwidth intensive as proxy caching, etc. cannot be used anymore. So I was thinking that using a signed request instead of HTTPS everywhere might also work e.g. this is how Amazon AWS does it http://aws.amazon.com/articles/1928#HTTP (assuming that the secret key was transferred to the client over SSL and stored locally)

But if the impact of using HTTPS is negligible, best to stick to that I guess.

]]> By: Patrick http://www.kalzumeus.com/2010/10/25/how-to-use-ssl-to-secure-your-rails-app-against-firesheep-and-other-evils/#comment-3562 Tue, 02 Nov 2010 09:25:22 +0000 http://www.kalzumeus.com/?p=1063#comment-3562 The impact is below negligible, Chaitanya.

]]> By: Chaitanya Gupta http://www.kalzumeus.com/2010/10/25/how-to-use-ssl-to-secure-your-rails-app-against-firesheep-and-other-evils/#comment-3561 Mon, 01 Nov 2010 18:24:06 +0000 http://www.kalzumeus.com/?p=1063#comment-3561 How has the switch to SSL affected your bandwidth and resource consumption?

]]> By: Sysadmin Sunday #3 « Boxed Ice Blog http://www.kalzumeus.com/2010/10/25/how-to-use-ssl-to-secure-your-rails-app-against-firesheep-and-other-evils/#comment-3560 Sun, 31 Oct 2010 16:03:44 +0000 http://www.kalzumeus.com/?p=1063#comment-3560 […] How To Use SSL To Secure Your Rails App Against FireSheep And Other Evils – protecting your site from Firesheep […]

]]> By: Lawrence Sinclair http://www.kalzumeus.com/2010/10/25/how-to-use-ssl-to-secure-your-rails-app-against-firesheep-and-other-evils/#comment-3559 Sat, 30 Oct 2010 22:51:47 +0000 http://www.kalzumeus.com/?p=1063#comment-3559 I will admit I didn’t read all the details above, but I did notice that you suggest having a site have some parts SSL and some parts non-SSL. Doesn’t that expose the cookies to session hijacking in the non-SSL part of the session? This is supposedly a vulnerability of some sites that are susceptible to firesheep, even though SSL appears to be enforced throughout the session.

]]>