This is why sites choose to stay vulnerable to Firesheep
1–10 of 143 posts
Re: This is why sites choose to stay vulnerable to Firesheep
#2Facebook and Twitter don't run Adsense, it's mostly run on content sites that don't require you log into them.
Re: This is why sites choose to stay vulnerable to Firesheep
#3Facebook and Twitter don't run Adsense, it's mostly run on content sites that don't require you log into them.
I don't understand your argument here--are you saying we shouldn't mind if the vulnerable sites aren't Facebook or Twitter?
Re: This is why sites choose to stay vulnerable to Firesheep
#4Facebook and Twitter don't run Adsense, it's mostly run on content sites that don't require you log into them.
I don't understand your argument here--are you saying we shouldn't mind if the vulnerable sites aren't Facebook or Twitter?
hes saying that most sites that use adsense do not require a login, thus do not need https. he is somewhat correct, but not enough for google to just ignore this issue.
Re: This is why sites choose to stay vulnerable to Firesheep
#5Earlier quoted context omitted.
I don't understand your argument here--are you saying we shouldn't mind if the vulnerable sites aren't Facebook or Twitter?
hes saying that most sites that use adsense do not require a login, thus do not need https. he is somewhat correct, but not enough for google to just ignore this issue.
Most content sites have login systems that people use to customize their experience, post comments or upload content, etc. Millions and millions and millions of people are logged into content sites and are vulnerable to this attack.
Also, I disagree on the premise that adsense is mostly used on content sites. It's used on all kinds of websites.
Re: This is why sites choose to stay vulnerable to Firesheep
#6Irrelevant contrarian opinion that adds nothing to the debate, but indicates with certainty I am more interested in being pedantic and scoring points than having a useful discussion.
Re: This is why sites choose to stay vulnerable to Firesheep
#7This is a problem we (GitHub) are facing in a big way right now. Google Charts doesn't offer https alternatives, so almost all our users get a big "this site is going to steal all your private information" (mixed content warning). We chose to roll out SSL first, then deal with the hard problem of mixed content warnings (building ridiculous image proxies) later.
I think a lot of developers underestimate how big of an impact this warning is on users, especially on browsers like IE that throw up a dialog on every page that has this warning. Developers understand that it's not that big of a deal — but to a user, it looks like the site is full of viruses, malware and is going to steal all your bank account information.
Re: This is why sites choose to stay vulnerable to Firesheep
#8Earlier quoted context omitted.
I don't understand your argument here--are you saying we shouldn't mind if the vulnerable sites aren't Facebook or Twitter?
hes saying that most sites that use adsense do not require a login, thus do not need https. he is somewhat correct, but not enough for google to just ignore this issue.
There are sites that make use of sessions without forcing you into using an account. These are also vulnerable.
Re: This is why sites choose to stay vulnerable to Firesheep
#9This is a problem we (GitHub) are facing in a big way right now. Google Charts doesn't offer https alternatives, so almost all our users get a big "this site is going to steal all your private information" (mixed content warning). We chose to roll out SSL first, then deal with the hard problem of mixed content warnings (building ridiculous image proxies) later. I think a lot of developers underestimate how big of an…
Not only that, but in IE it's a modal dialog. You can't do anything (even switch to another tab) until you've acknowledged the scary warning.
Re: This is why sites choose to stay vulnerable to Firesheep
#10Is the solution to Firesheep to have every logged in page in https? Or is this not necessary?