(click image for larger view)

Slideshow: How Firesheep Can Hijack Web Sessions

Know how to shop safe this holiday season. That's the warning from a new study of online shopping habits, which found that 52% of people don't check for an HTTPS connection before making e-commerce purchases, and 50% don't look for the browser padlock icon which indicates that data is being exchanged in encrypted format with websites.

Those findings come from a new survey of more than 2,600 people in Australia, the United Kingdom, and the United States, conducted by ResearchNow for security firm Webroot.

"Through our survey, we learned that one in seven respondents has already become a victim of credit, debit, or PayPal account fraud this year," said Jeff Horne, threat research director at Webroot, in a statement. "In addition, 57% received phishing emails from bogus sources claiming to be a legitimate company -- something we see rise around Black Friday and Cyber Monday," aka the Monday after Thanksgiving.

The Webroot survey study also found regular use of free Wi-Fi for e-commerce purposes. For example, 23% of respondents said they feel safe when using a public wireless connection, and 18% of respondents said they'd likely shop for gifts when logged into free, public Wi-Fi hotspots.

Yet, attackers can sniff sensitive data sent via Wi-Fi hotspots, since many websites -- as well as hotspots -- don't use SSL to fully encrypt all sessions. The risk was highlighted earlier this month by the release of Firesheep, a Firefox extension which automatically sniffs communications between people using the same hotspot and such websites as Amazon.com, unless defensive measures are taken.

On the upside, however, the study found that 52% of consumers only buy from websites which offer some type of trust certification, issued by such outfits as the Better Business Bureau (BBB) and VeriSign. Furthermore, 72% of people use complex passwords that mix letters, numbers, and symbols, and 62% don't save passwords in their browser. But only 37% of people use unique passwords for each password-protected website at which they shop.

When shopping, Webroot recommends never conducting a financial transaction on a website unless it displays "HTTPS" in the address bar. In addition, it said that "on sites where the retailer uses extended SSL validation, look for the address bar to turn green on secured pages."

While researchers have shown that SSL can be bypassed by a determined attacker using a man-in-the-middle attack, and that padlock icons can be faked, security experts say they're still a better-than-nothing indicator of a secure browsing session.

Network Computing has published an in-depth report on securing your network boundaries. Download the report here (registration required).