Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firesheep usage leads to Idiocy

jonty.co.uk

Post reply on HN
Print view View original

51–60 of 89 posts

Re: Firesheep usage leads to Idiocy

#51

Post by NathanKP »

Natsu wrote: post #46
NathanKP wrote: post #15

Earlier quoted context omitted.

I understand. Mainly I'm just worried that people aren't thinking things through completely when they make a tool like this freely available. Personally I expect that Firesheep will be used mostly by 4chan, script kiddies, and others who just want lulz. Idiocy is clearly an attempt to use the same concepts for good, but it is still mildly worrying from the point of view of the methods being used to accomplish the goa…

Could we not use "terrorist style" to describe things like this? I don't think anybody is going to get killed over this.

I think it is sort of interesting that terrorism is such a loaded term that people object to its use. Terrorism doesn't have to involve killing people. It just means scaring people into doing what you want.

Re: Firesheep usage leads to Idiocy

#52

Post by tertius »

lotharbot wrote: post #48
hugh3 wrote: post #45

Earlier quoted context omitted.

And how do you point it out to them? As discreetly as possible, or by shouting it to all their friends?

If half of their friends also have their fly open, shouting it might be a better option.

You can see their friends' flies open? That's one ninja technique that I didn't want to know about.

Point is, you don't know, so don't assume.

Re: Firesheep usage leads to Idiocy

#53

Post by jgrahamc »

codexon wrote: post #50

I don't like it that Firesheep is driving everyone to use HTTPS. You cannot have multiple SSL certs on a single IP and you have to pay a significant amount to get a cert that won't pop up an annoying page which turns away most non-technical users. There needs to be an alternative which just does key exchange and symmetric encryption without the identification.

Your alternative to SSL would allow MITM attacks. Thus it would be useless.

Re: Firesheep usage leads to Idiocy

#54

Post by codexon »

jgrahamc wrote: post #53
codexon wrote: post #50

I don't like it that Firesheep is driving everyone to use HTTPS. You cannot have multiple SSL certs on a single IP and you have to pay a significant amount to get a cert that won't pop up an annoying page which turns away most non-technical users. There needs to be an alternative which just does key exchange and symmetric encryption without the identification.

Your alternative to SSL would allow MITM attacks. Thus it would be useless.

I don't see another compromise that wouldn't require the signature infrastructure.

MITM attacks are much less common than sniffing attacks as we can see here.

Re: Firesheep usage leads to Idiocy

#55

Post by astine »

lotharbot wrote: post #48
hugh3 wrote: post #45

Earlier quoted context omitted.

And how do you point it out to them? As discreetly as possible, or by shouting it to all their friends?

If half of their friends also have their fly open, shouting it might be a better option.

If everyone's flies are open, you've wandered onto the set of a gay porno.

Re: Firesheep usage leads to Idiocy

#56

Post by jgrahamc »

codexon wrote: post #54
jgrahamc wrote: post #53

Earlier quoted context omitted.

Your alternative to SSL would allow MITM attacks. Thus it would be useless.

I don't see another compromise that wouldn't require the signature infrastructure. MITM attacks are much less common than sniffing attacks as we can see here.

If people moved to your scheme MITM would become common and we'd be writing about FirePiggyInTheMiddle or similar. They can be automated. You need some trust infrastructure for encryption to work.

Re: Firesheep usage leads to Idiocy

#57

Post by dandelany »

lotharbot wrote: post #48
hugh3 wrote: post #45

Earlier quoted context omitted.

And how do you point it out to them? As discreetly as possible, or by shouting it to all their friends?

If half of their friends also have their fly open, shouting it might be a better option.

I'm missing the logic here. If few people make a mistake, they should be informed privately, but if many people make a mistake, they should be shamed publicly? No.

And to be honest, I'm getting slightly tired of the community's tendency to stretch metaphors way beyond their applicability. Mine was mostly meant to add a touch of humor. Pants, flies, and underwear aside, auto-hijacking the Twitter accounts of everyone on your network is just dickish (no pun intended). Especially when the belt store is closed to everyone except the pants-manufacturers ;)

Re: Firesheep usage leads to Idiocy

#58

Post by bensummers »

codexon wrote: post #50

I don't like it that Firesheep is driving everyone to use HTTPS. You cannot have multiple SSL certs on a single IP and you have to pay a significant amount to get a cert that won't pop up an annoying page which turns away most non-technical users. There needs to be an alternative which just does key exchange and symmetric encryption without the identification.

There's a 'new' TLS (SSL) feature called Server Name Indication, which allows more than one cert per IP address.

http://en.wikipedia.org/wiki/Server_Name_Indication

It has surprisingly high client support, but obviously isn't universal enough for you to rely on it working.

With a protocol which doesn't require a certificate, you're still subject to MITM attacks. These are particularly viable on public wifi networks -- just set up a rogue access point.

Re: Firesheep usage leads to Idiocy

#59

Post by codexon »

jgrahamc wrote: post #56
codexon wrote: post #54

Earlier quoted context omitted.

I don't see another compromise that wouldn't require the signature infrastructure. MITM attacks are much less common than sniffing attacks as we can see here.

If people moved to your scheme MITM would become common and we'd be writing about FirePiggyInTheMiddle or similar. They can be automated. You need some trust infrastructure for encryption to work.

In order to do FirePiggyInTheMiddle, you need to control the router. You can't just sit in the subnet and start sending commands to random clients to hijack their connection, especially when it is symmetrically encrypted.

Re: Firesheep usage leads to Idiocy

#60

Post by thwarted »

codexon wrote: post #59
jgrahamc wrote: post #56

Earlier quoted context omitted.

If people moved to your scheme MITM would become common and we'd be writing about FirePiggyInTheMiddle or similar. They can be automated. You need some trust infrastructure for encryption to work.

In order to do FirePiggyInTheMiddle, you need to control the router. You can't just sit in the subnet and start sending commands to random clients to hijack their connection, especially when it is symmetrically encrypted.

A much more likely and easier setup is to poison DNS with results that direct the victim to your own machine.
Post reply on HN