11–16 of 16 posts
Not related to Twitter, but I saw this in the comments: Facebook does now have an 'enable SSL by default' option. Account> Account Settings> Account Security> Secure Browsing (https)
So someone in the audience was using Firesheep. Horrors. https://twitter.com FTW
I agree. This strikes me as non-news. Side-jacking is a bad thing. We get it. Use VPN, use SSH tunneling, in general don't be dumb when using an open network. If possible use the https version.
Not related to Twitter, but I saw this in the comments: Facebook does now have an 'enable SSL by default' option. Account> Account Settings> Account Security> Secure Browsing (https)
End to end crypto is great, but I generally use a VPN whenever logging in from a public network for all traffic, just to avoid this -- anyone sniffing my Gig-E uplink at the colo, or the backbone, or the site, will hopefully only see SSL traffic to sites, but just in case, I'd rather put an extra barrier up for the easy coffeeshop wireless sniffing attacker.
If you're using a public internet connection, make sure you're at least using a SOCKS proxy to browse or IM. Pretty simple setup: ssh -ND 8001 me@myserver, and use proxy localhost:8001.
Not related to Twitter, but I saw this in the comments: Facebook does now have an 'enable SSL by default' option. Account> Account Settings> Account Security> Secure Browsing (https)
http://www.f-secure.com/weblog/archives/00002106.html
"I tested several times and each time I found an application that asked me to "continue" to a "regular connection", my default Account Security settings reverted to HTTP."
End to end crypto is great, but I generally use a VPN whenever logging in from a public network for all traffic, just to avoid this -- anyone sniffing my Gig-E uplink at the colo, or the backbone, or the site, will hopefully only see SSL traffic to sites, but just in case, I'd rather put an extra barrier up for the easy coffeeshop wireless sniffing attacker.
I came here to post this. You don't have to sit around and wait for Twitter to implement SSL. Many who implement SSL don't do so correctly anyway. If you're using a public internet connection, make sure you're at least using a SOCKS proxy to browse or IM. Pretty simple setup: ssh -ND 8001 me@myserver, and use proxy localhost:8001.
Yea, be careful in particular with mixed content. Depending on the origin of the insecure content and depending on whether the cookie was marked as "secure", these may or may not leak plaintext cookies.