Live data from Hacker News

Firesheep, Week+ later

news.ycombinator.com

21–22 of 22 posts

Re: Firesheep, Week+ later

#21
post #14
post #7

At least one site, GitHub, has certainly deployed changes as a result (and also pointed out that the author of Firesheep gave absolutely zero warning to the sites it targeted, which unnecessarily left a great many users vulnerable on sites like GitHub that would have otherwise been able to close the hole before Firesheep made it public information).

unnecessarily left a great many users vulnerable on sites Except that Firesheep didn't expose any new security problem. "Hey everyone, in a few weeks I'm going to make it easier for people to exploit long-known security problems that you may have been happily ignoring" is different to "Hey everyone, I found a brand new vulnerability and I want to let you fix it before I publish it".

It doesn't matter if it's not new information or if the companies knew about it or not. It's something that should be done to avoid screwing people over. Users don't always know about this stuff. Before publishing a tool that makes it so easy to exploit users info it's a common practice to inform the companies related ahead of time in case they are motivated to fix this (such as github did) and perhaps the users so they can have heard about it before everyone has it and they are still logging in like this.

Re: Firesheep, Week+ later

#22
post #17
post #16

Earlier quoted context omitted.

I'm sorry, but this is a cop-out. Even five minutes of thought on how you authenticate your users would have shown that it depends on one string being a secret. Most people acknowledge that passwords shouldn't be passed in the clear. So what's the difference between a password and a session cookie in terms of its sensitivity. This is security 101. I think its highly irresponsible, and a disservice to users of all web…

The vulnerability is wide-spread, but Firesheep was released with handlers written targeting specific sites, including GitHub. So, yes, I would have appreciated a heads up from those guys.

OK, I understand why creating specific handlers might warrant a heads up.

I suppose I'm unsympathetic since every authenticated web app I've done in the last 10 years has been SSL only. But that was too 'enterprisey' perhaps :). Also I imagine that this is such an obvious thing, it wasn't a case of being unaware of the issue, just taking a conscious risk-reward decision on being SSL-only. Particularly for the really smart developers at github. One could argue that since nothing bad (that we know of) happened before firesheep, it was a valid decision.

All in all, I think Firesheep has done a big favour to the web as a whole.

PS. this thread has degenerated to using github as an example, I should probably point out that I love and respect github. really.

Post reply on HN