This is why sites choose to stay vulnerable to Firesheep • Hacker News Board

Re: This is why sites choose to stay vulnerable to Firesheep

#11

Post by harshpotatoes » Sun, Nov 07, 2010, 10:31 PM UTC

ericflo wrote: post #3

yanw wrote: post #2

Facebook and Twitter don't run Adsense, it's mostly run on content sites that don't require you log into them.

I don't understand your argument here--are you saying we shouldn't mind if the vulnerable sites aren't Facebook or Twitter?

I think he's arguing that since both twitter and facebook (and other unnamed sites) do not use adsense, but are still vulnerable to firesheep, there must be another reason why developers don't update the security for their website.

Re: This is why sites choose to stay vulnerable to Firesheep

#12

Post by templaedhel » Sun, Nov 07, 2010, 10:32 PM UTC

ericflo wrote: post #9

kneath wrote: post #7

This is a problem we (GitHub) are facing in a big way right now. Google Charts doesn't offer https alternatives, so almost all our users get a big "this site is going to steal all your private information" (mixed content warning). We chose to roll out SSL first, then deal with the hard problem of mixed content warnings (building ridiculous image proxies) later. I think a lot of developers underestimate how big of an…

Not only that, but in IE it's a modal dialog. You can't do anything (even switch to another tab) until you've acknowledged the scary warning.

Thats why I use IE6. No tabs, no problem.

Re: This is why sites choose to stay vulnerable to Firesheep

#13

Post by tptacek » Sun, Nov 07, 2010, 10:36 PM UTC

benblack wrote: post #6

Irrelevant contrarian opinion that adds nothing to the debate, but indicates with certainty I am more interested in being pedantic and scoring points than having a useful discussion.

Successfully executed.

Re: This is why sites choose to stay vulnerable to Firesheep

#14

Post by elliottcarlson » Sun, Nov 07, 2010, 10:37 PM UTC

ericflo wrote: post #5

ryanto wrote: post #4

Earlier quoted context omitted.

hes saying that most sites that use adsense do not require a login, thus do not need https. he is somewhat correct, but not enough for google to just ignore this issue.

Most content sites have login systems that people use to customize their experience, post comments or upload content, etc. Millions and millions and millions of people are logged into content sites and are vulnerable to this attack. Also, I disagree on the premise that adsense is mostly used on content sites. It's used on all kinds of websites.

Most notably would be the oodles of forums out there that are ad supported and require logging in.

Re: This is why sites choose to stay vulnerable to Firesheep

#15

Post by EricButler » Sun, Nov 07, 2010, 10:37 PM UTC

While sites wait for services such as adsense to support SSL, adding a second Secure cookie and requiring on sensitive pages and to perform destructive actions can help reduce risk to users. Depending on the site, it may be OK to skip showing ads on a few authenticated pages. Wordpress implemented this in 2008: http://ryan.boren.me/2008/07/14/ssl-and-cookies-in-wordpress...

This won't protect against active attackers, but is definitely a step forward and will make a full transition easier in the future, when possible.

Re: This is why sites choose to stay vulnerable to Firesheep

#16

Post by ryanto » Sun, Nov 07, 2010, 10:37 PM UTC

kneath wrote: post #7

This is a problem we (GitHub) are facing in a big way right now. Google Charts doesn't offer https alternatives, so almost all our users get a big "this site is going to steal all your private information" (mixed content warning). We chose to roll out SSL first, then deal with the hard problem of mixed content warnings (building ridiculous image proxies) later. I think a lot of developers underestimate how big of an…

Yup, I agree with you. This is a pretty big problem with a lot of other google services as well.

The google maps api for example will not work behind https. Google has publicly said that this is because they want their maps free and open, not behind some page where the user needs to be logged in. This create a huge problem for any site that uses google maps. They do offer a solution though, for $10,000 a year they will let you use the map api behind https.

Re: This is why sites choose to stay vulnerable to Firesheep

#17

Post by Udo » Sun, Nov 07, 2010, 10:40 PM UTC

kneath wrote: post #7

This is a problem we (GitHub) are facing in a big way right now. Google Charts doesn't offer https alternatives, so almost all our users get a big "this site is going to steal all your private information" (mixed content warning). We chose to roll out SSL first, then deal with the hard problem of mixed content warnings (building ridiculous image proxies) later. I think a lot of developers underestimate how big of an…

Exactly. Browser makers (including Mozilla/Firefox to a large degree) are responsible for the fact that HTTPS hasn't become the standard protocol as it should have been years ago. It's not only the unproductive mixed content warning but also the insistence of all browsers to only accept expensively bought certificates and throw a very scary and hard to overcome error dialog if a site uses any other kind of cert. While that isn't a problem for big(gish) commercial sites like GitHub, it presents an insurmountable hurdle for private sites and small-time projects for no good reason. For most sites I don't need "secure" origin verification as badly as encryption. The lack of a verifiable server address shouldn't mean that I should be bullied to not use an encrypted connection with it. But even if the verdict is that you absolutely can't have one without the other, browser makers should AT LEAST include trusted root certs of authorities who offer free SSL certificates, too.

Re: This is why sites choose to stay vulnerable to Firesheep

#18

Post by drivingmenuts » Sun, Nov 07, 2010, 10:42 PM UTC

Honestly, how many sites are aware that they are vulnerable?

It seems like you assume that because the security-oriented 0.5% of the web knows about it, the rest of the web should, too.

For most people, just making sure that their site runs at all is quite enough for them to handle, and keeping current on the latest vulnerabilities is way down on the list.

Additionally, fixing a site takes time. How long has Firesheep been out? A week? Two? You should realize that for many sites, even those staffed by very competent tech people, a month is the minimum amount of time for immediate action.

Re: This is why sites choose to stay vulnerable to Firesheep

#19

Post by mickeyben » Sun, Nov 07, 2010, 10:42 PM UTC

kneath wrote: post #7

This is a problem we (GitHub) are facing in a big way right now. Google Charts doesn't offer https alternatives, so almost all our users get a big "this site is going to steal all your private information" (mixed content warning). We chose to roll out SSL first, then deal with the hard problem of mixed content warnings (building ridiculous image proxies) later. I think a lot of developers underestimate how big of an…

We discovered the exact same issue and rolled back few weeks ago.

The worst is that the default selected choice in the modal box is to not load anything.

Re: This is why sites choose to stay vulnerable to Firesheep

#20

Post by _cbsz » Sun, Nov 07, 2010, 10:43 PM UTC

kneath wrote: post #7

This is a problem we (GitHub) are facing in a big way right now. Google Charts doesn't offer https alternatives, so almost all our users get a big "this site is going to steal all your private information" (mixed content warning). We chose to roll out SSL first, then deal with the hard problem of mixed content warnings (building ridiculous image proxies) later. I think a lot of developers underestimate how big of an…

The warning isn't spurious, by the way. A man in the middle could inject evil JS into urchin.js (or whatever the equivalent is now) just as easily as he could inject it into your site's JS; the page is not secure.