I'm eagerly waiting trying this out once a Linux version becomes available.. looks very nice! Unfortunately I don't have a Windows or OS X installation available to me at the moment.
Firesheep: Easy HTTP session hijacking from within Firefox
321–330 of 356 posts
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#322Earlier quoted context omitted.
This is a stupid question, but what about a guy like me who has no access to a server? I'm going traveling for all of next month, the only sites I'll be checking where I'll be logged in is my hotmail account, and I might check my bank account (Chase) - both use https, so I suppose I'm in the clear then? (also when I click "log out" on these sites, it logs me out, but if my session has been hijacked, will it log the h…
A cheap linux VPS is a couple bucks a month. Mine is three. If you aren't looking for a deal, there are many many options at the 5 dollar price point. If five bucks is worth peace of mind for the next month, then that's your answer. This will also have the benefit of getting around filters that are operating on WiFi network you are on.
An Amazon EC2 micro instance is free for a year.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#323Earlier quoted context omitted.
This is a stupid question, but what about a guy like me who has no access to a server? I'm going traveling for all of next month, the only sites I'll be checking where I'll be logged in is my hotmail account, and I might check my bank account (Chase) - both use https, so I suppose I'm in the clear then? (also when I click "log out" on these sites, it logs me out, but if my session has been hijacked, will it log the h…
I would consider paying for VPN access. I travel a bit and use Witopia for this. It's not very expensive and is quite convenient.
Would the free Amazon EC2 deal for a year be good for this?
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#324Earlier quoted context omitted.
A cheap linux VPS is a couple bucks a month. Mine is three. If you aren't looking for a deal, there are many many options at the 5 dollar price point. If five bucks is worth peace of mind for the next month, then that's your answer. This will also have the benefit of getting around filters that are operating on WiFi network you are on.
An Amazon EC2 micro instance is free for a year.
So I could go get a free VPS for a year through Amazon with this?
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#325Earlier quoted context omitted.
Agreed, but I still think giving someone else full control is a bit too much. It's not the user's fault (most don't even know this is happening) and they're likely to be the victims here.
The script kiddies already have their scripts and already do this. Firesheep will hopefully allow users to see the problem in a way they can clearly understand.
btw, did you use showoff for http://codebutler.github.com/firesheep/tc12/#1
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#326what version of firefox do you need to have to run it? i can't get it to work.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#327Earlier quoted context omitted.
You win a cookie! I was wondering how long it would take for someone to comment on that. :)
I thought the whole point of this mechanism was to avoid giving away cookies?
Insecurely transmitted cookies. I think it safe to assume these two will negotiate a means of exchanging keys to their respective cookie jars.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#328There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft". How many millions of dollars and man hours is it going to take to lock down every access point…
Please reread the name of this site. I'm surprised that so many members of a site named "Hacker News" agree with you that what is clearly a very clever hack is inherently a bad thing.
This "clever hack" is costing a lot of people a lot of money today.
Concrete example: are you a location based startup? Well, you might need to shell out $10,000 for a Google Maps API Premier key in order to get HTTPS.
"Access to the API via a secure HTTPS connection" http://code.google.com/apis/maps/documentation/premier/guide...
"Google Maps API Premier is extremely cost-effective, starting at just $10,000 per year." http://www.google.com/enterprise/earthmaps/maps_features.htm...
Multiply that by thousands and you'll begin to have some idea of the discussions going on at every web based company with a clue today.
For those who make their living in computer security, like Mr. Butler, of course it's a good day (and month, and year). Pretty good business when you can start fires and then get paid well to put them out. Serves them right, of course, because they shouldn't have built that house out of wood in the first place.
While we're on the topic, I don't understand how a lot of people fail to realize that spending on computer security is a lot like spending on national security -- you can always spend more money on it, thereby taking away resources from other priorities.
http://www.goodreads.com/author/quotes/23920.Dwight_D_Eisenh...
"Every gun that is made, every warship launched, every rocket fired signifies in the final sense, a theft from those who hunger and are not fed, those who are cold and are not clothed. This world in arms is not spending money alone. It is spending the sweat of its laborers, the genius of its scientists, the hopes of its children. This is not a way of life at all in any true sense. Under the clouds of war, it is humanity hanging on a cross of iron."
-- Eisenhower
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#329There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft". How many millions of dollars and man hours is it going to take to lock down every access point…
when you log into most banks and websites that perform financial transactions you are routed to an SSL logon, its a default choice, in fact most of the transactions are done under SSL. why should social networks be different?!
by now it is clear that unauthorized access to social networks can cause much distress and even worse to a great many people who use them.
Banks minimize their liability when they use SSL, facebook should do this too. at this point it should be clear that the effect on a person social life can be severe, career destroying, financially damaging, what have you, we are witnessing stories along these lines in increasing rates.
The release of this extension is a blessing in my view, it forces the issue that companies like facebook or twitter would prefer to ignore, or cover in obscure terminology, this simply demonstrates how trivial this is.
When Ingersoll Rand released the Kryptonite lock, they named it after the mythical element that would bring superman to his knees. Too bad the lock was revealed to have a design flaw that enabled cracking it up with a BIC pen, was it shameful to display that defective design?
Facebook etc... talk about privacy all the time. This forces them to walk the walk, not just talk.