Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firesheep usage leads to Idiocy

jonty.co.uk

Post reply on HN
Print view View original

61–70 of 89 posts

Re: Firesheep usage leads to Idiocy

#61

Post by tcskeptic »

NathanKP wrote: post #8
Groxx wrote: post #6

Earlier quoted context omitted.

Unless they're running a honey-pot machine... how do they tell? You're coming from the same IP, with the same session. At best they can fingerprint your browser, which is far from proof and easy to change. Or nab things from Flash, maybe - but people likely to use this exploit to educate are probably more likely to run Flash blockers.

While it may be unlikely for you to get caught in my mind that still doesn't make it a good idea to run Idiocy. In essence I consider it to be a form of cyber terrorism. Terrorists use illegal or unsavory acts to gain attention and draw media coverage of their cause. Essentially idiocy is just cyber terrorism. It says "Look! I can take over your account. Now that you are scared let me show you what I want you to do."…

In my opinion this kind of cheapening of the language kills our ability to communicate as human beings. When you compare being redirected involuntarily to a polite note that helps you understand how currently insecure your use of twitter is to vicious and violent acts, many of which result in the brutal death of innocent bystanders, acts in which mothers watch their children die in agony, you debase the language to such an extent as to be talking babble.

I don't know what the rhetorical strategy is called that you have employed, but it is beneath you.

Re: Firesheep usage leads to Idiocy

#62

Post by btilly »

dandelany wrote: post #57
lotharbot wrote: post #48

Earlier quoted context omitted.

If half of their friends also have their fly open, shouting it might be a better option.

I'm missing the logic here. If few people make a mistake, they should be informed privately, but if many people make a mistake, they should be shamed publicly? No. And to be honest, I'm getting slightly tired of the community's tendency to stretch metaphors way beyond their applicability. Mine was mostly meant to add a touch of humor. Pants, flies, and underwear aside, auto-hijacking the Twitter accounts of everyone…

Random public shaming may not be fair, but it is a fast way to get the message out to lots of people. And I've seen it be an effective way to drive behavior change.

Re: Firesheep usage leads to Idiocy

#63

Post by sedachv »

It's possible to mitigate HTTP session hijacking without resorting to SSL: http://carcaddar.blogspot.com/2010/10/protect-flock-or-how-t...

It's not really viable to serve most things over HTTPS because there's no hope of caching anywhere but at the end-point (and that's usually disabled by default, too).

Re: Firesheep usage leads to Idiocy

#64

Post by NathanKP »

tcskeptic wrote: post #61
NathanKP wrote: post #8

Earlier quoted context omitted.

While it may be unlikely for you to get caught in my mind that still doesn't make it a good idea to run Idiocy. In essence I consider it to be a form of cyber terrorism. Terrorists use illegal or unsavory acts to gain attention and draw media coverage of their cause. Essentially idiocy is just cyber terrorism. It says "Look! I can take over your account. Now that you are scared let me show you what I want you to do."…

In my opinion this kind of cheapening of the language kills our ability to communicate as human beings. When you compare being redirected involuntarily to a polite note that helps you understand how currently insecure your use of twitter is to vicious and violent acts, many of which result in the brutal death of innocent bystanders, acts in which mothers watch their children die in agony, you debase the language to s…

Personally I believe the exact opposite. It is important that we break free from the political propaganda that says that terrorism means a suicide bomber that kills others, and recognize that the basic concept of terrorism is used all the time by our own respective governments and other power figures.

I see it as terrorism when a religious leader tells people that they will go to hell for not following religious tenants. I see it as terrorism when a government uses FUD on its own people to get them to support a war on another nation.

I also see it as a form of terrorism to take over someone's account and post something in their name. The average person who discovers that someone has hijacked their account and posted in their name is going to feel angry and afraid.

As far as I see it Idiocy and Firesheep can be used in the same manner as terrorism: to frighten people by threatening them. Sure the threat of taking over an online account is much less than the threat of death by a suicide bomb, but I see no reason why it should not be called terrorism.

Instead I find it fascinating that there is so much negative feelings toward me personally for using the word terrorism. Is it suddenly non-kosher to make a comparison? You say I am "cheapening language skills" and "talking babble". I am just surprised at your vehement response, and the general dislike of my use of the word.

I have a broad view of what terrorism is, you evidently have a very narrow view. If you do not want to broaden your view of what a terrorist act can be, then you will not notice the many subtle acts of terrorism committed. If people insist that terrorism can only be applied to acts of physical violence then they will be unaware of the way governments, political leaders, religious leaders, and others use fear to control the masses.

But the point of my comments originally were not to define terrorism, but instead to explain why I might disapprove of Idiocy. Instead it appears to have turned into a large discussion on whether or not it is right to use the word terrorism to describe something which scares someone into changing their actions or habits.

At any rate, downvotes do not hurt me, but I am disappointed by the narrow view of what the word terrorism means.

Re: Firesheep usage leads to Idiocy

#65

Post by seltzered »

alanh wrote: post #30
seltzered wrote: post #25

Speaking of this, when will HN allow for HTTPS connections? :P

Post a feature request: http://news.ycombinator.com/item?id=363

thanks, I noticed user culix already suggested it, so I upvoted his suggestion: http://news.ycombinator.com/item?id=499851

Re: Firesheep usage leads to Idiocy

#66

Post by jontywareing »

drivingmenuts wrote: post #36

"Given that most websites will not be making SSL the default any time soon, the only option is to educate people." And this educates them how, exactly? Education thru vandalism is just vandalism.

It educates by providing information about the attack used and how to prevent it happening in the future. You can find the link provided to users here: http://jonty.co.uk/idiocy-what

The tweet can be instantly removed by the user. It's hardly vandalism as nothing is being damaged or destroyed.

As I've said in a message elsewhere in this thread, posting to your own account is an easily understandable visible demonstration of what's possible and why they should care - a DM from another account, or an @ just won't have the same effect on the user.

I've been informed that it's possible to send a DM to yourself, so I'm going to add that as an option shortly.

Re: Firesheep usage leads to Idiocy

#67

Post by jontywareing »

dandelany wrote: post #57
lotharbot wrote: post #48

Earlier quoted context omitted.

If half of their friends also have their fly open, shouting it might be a better option.

I'm missing the logic here. If few people make a mistake, they should be informed privately, but if many people make a mistake, they should be shamed publicly? No. And to be honest, I'm getting slightly tired of the community's tendency to stretch metaphors way beyond their applicability. Mine was mostly meant to add a touch of humor. Pants, flies, and underwear aside, auto-hijacking the Twitter accounts of everyone…

I do not think this can really be considered "shaming" as it's nothing to be embarrassed about.

Regarding private/public notification; Posting to your own account is an easily understandable visible demonstration of what's possible and why you should care - a DM from another account, or an @ just won't have the same effect on the user.

(I have said this elsewhere in the thread, so apologies for repetition)

I have been informed that it's possible to send a DM to yourself, so I'll add that as an option shortly as a nice alternative.

Re: Firesheep usage leads to Idiocy

#68

Post by wmf »

codexon wrote: post #59
jgrahamc wrote: post #56

Earlier quoted context omitted.

If people moved to your scheme MITM would become common and we'd be writing about FirePiggyInTheMiddle or similar. They can be automated. You need some trust infrastructure for encryption to work.

In order to do FirePiggyInTheMiddle, you need to control the router. You can't just sit in the subnet and start sending commands to random clients to hijack their connection, especially when it is symmetrically encrypted.

ARP poisoning doesn't require control of the router; it makes MITMs pretty trivial.

http://www.windowsecurity.com/articles/Understanding-Man-in-...

Re: Firesheep usage leads to Idiocy

#69

Post by evilduck »

NathanKP wrote: post #64
tcskeptic wrote: post #61

Earlier quoted context omitted.

In my opinion this kind of cheapening of the language kills our ability to communicate as human beings. When you compare being redirected involuntarily to a polite note that helps you understand how currently insecure your use of twitter is to vicious and violent acts, many of which result in the brutal death of innocent bystanders, acts in which mothers watch their children die in agony, you debase the language to s…

Personally I believe the exact opposite. It is important that we break free from the political propaganda that says that terrorism means a suicide bomber that kills others, and recognize that the basic concept of terrorism is used all the time by our own respective governments and other power figures. I see it as terrorism when a religious leader tells people that they will go to hell for not following religious tena…

You can't just choose to neglect to connotations a word carries with it and expect everyone else to do the same, especially while those connotations are still culturally relevant.

Terrorism carries certain meanings in today's political climate, and by using it loosely, you're implicitly linking session hijacking as a means to spread awareness of a longstanding vulnerability to a religious, political and usually violent term. It's akin to calling someone a Nazi, even if there is a comparison to Nazism that could be made.

Feel free to use it as you want, but to expect any other reaction than the one you got is wishful thinking.

Re: Firesheep usage leads to Idiocy

#70

Post by NathanKP »

evilduck wrote: post #69
NathanKP wrote: post #64

Earlier quoted context omitted.

Personally I believe the exact opposite. It is important that we break free from the political propaganda that says that terrorism means a suicide bomber that kills others, and recognize that the basic concept of terrorism is used all the time by our own respective governments and other power figures. I see it as terrorism when a religious leader tells people that they will go to hell for not following religious tena…

You can't just choose to neglect to connotations a word carries with it and expect everyone else to do the same, especially while those connotations are still culturally relevant. Terrorism carries certain meanings in today's political climate, and by using it loosely, you're implicitly linking session hijacking as a means to spread awareness of a longstanding vulnerability to a religious, political and usually viole…

I understand what you are saying. Perhaps comparing session hijacking to terrorism is a little too harsh when it is put like that.

It is still the closest word I can think of which describes what one does if they run Idiocy: threaten other people's online confidence and make them more frightened, and hence more cautious in the future.

Only time will tell if Firesheep and Idiocracy are the 9/11 of the online world, leading to more HTTPS (compared to the way real world terrorism resulted in more airport security protocols). Although it might seem harsh there are a lot of similarities.

Post reply on HN