Preventing Session Hijacking

This past week a Firefox browser extension called Firesheep has been causing a stir on the web. Firesheep demonstrates how it's possible under certain circumstances to hijack website 'sessions' on another user's computer when you're sharing the same network - like when you're using FreeAgent at your local Starbucks. Since sessions are used to control access to pretty much all web applications - including FreeAgent - the security implications of session hijacking are clear.

We use a secure SSL connection for all requests to the application (like online banks, FreeAgent web addresses start with https rather than http), but unfortunately FreeAgent has been susceptible to session hijack attacks at the point at which you were logging in via our website home page or otherwise using a link which had been manually changed to http.

Of course we've now rectified this so you can be completely sure no-one is listening in, and we've had no reports of anyone being affected. But anyway, you can rest assured that we take this stuff seriously and we're very proactive in responding to such issues as soon as they rear their ugly heads.

Recent Posts

Twitter Love

  • Great #CustomerService from @freeagent this afternoon. A great system for looking after finances of small business.

  • Every day I realise how @FreeAgent is essential for a one man UK company — #BestWebAppInYears #AccountancyForDummies

  • Have I mentioned that @FreeAgent is the best thing since sliced bread? Don't run a one man UK company without it.

  • It took me long enough, but accounting software has changed my life! for personal stuff, I use @ynab & @freeagent for business #bookkeeping

  • @freeagent Good software = you do something, and it does exactly what you expected. I type "now" @timestamphq starts a timer. Perfect.