Firesheep and Side-Jacking
If you are are not aware of the term "side-jacking" let me bring you up to speed.
"When logging into a website you usually start by submitting your username and password. The server then checks to see if an account matching this information exists and if so, replies back to you with a "cookie" which is used by your browser for all subsequent requests.
It's extremely common for websites to protect your password by encrypting the initial login, but surprisingly uncommon for websites to encrypt everything else. This leaves the cookie (and the user) vulnerable. HTTP session hijacking (sometimes called "sidejacking") is when an attacker gets a hold of a user's cookie, allowing them to do anything the user can do on a particular website. On an open wireless network, cookies are basically shouted through the air, making these attacks extremely easy." http://codebutler.github.com/firesheep
The automation of this process now has a easy to use Firefox plugin (for simple transfer to a new browser) with a tool called "Firesheep".
This has many security implications on both Infrastructure and Personnel. The ability to compromise sessions inprogress and to be able to view active sessions is a significant issues that needs to addressed. Encrypted HTTP sessions that remain secure, from initiation to termination is essential.
Cheers,
_J