GitHub moves to SSL, but remains Firesheepable

#1

Post by makuro » Wed, Nov 03, 2010, 2:53 PM UTC

GitHub moves to SSL, but remains Firesheepable
news.netcraft.com

Re: GitHub moves to SSL, but remains Firesheepable

#2

Post by tptacek » Wed, Nov 03, 2010, 4:16 PM UTC

I'm torn between the fact that Netcraft wrote a rather large blog post taking Github to task for a simple oversight --- against the fact that there is a pervasive misconception that the HTTP cookie "Secure" flag is not a big deal. The "Secure" flag is a very big deal. You might as well not be SSL without it.

Re: GitHub moves to SSL, but remains Firesheepable

#3

Post by rtomayko » Wed, Nov 03, 2010, 4:33 PM UTC

We fat fingered the config. The cookie is marked secure now but we found another issue where it's being sent back on redirected HTTP requests. It should be all plugged up in a bit.

Re: GitHub moves to SSL, but remains Firesheepable

#4

Post by rtomayko » Wed, Nov 03, 2010, 4:58 PM UTC

rtomayko wrote: post #3

We fat fingered the config. The cookie is marked secure now but we found another issue where it's being sent back on redirected HTTP requests. It should be all plugged up in a bit.

Okay. The session cookie is marked secure and is sent only in response to HTTPS requests. That should cover everything.

Re: GitHub moves to SSL, but remains Firesheepable

#5

Post by percept » Wed, Nov 03, 2010, 5:02 PM UTC

rtomayko wrote: post #4

rtomayko wrote: post #3

We fat fingered the config. The cookie is marked secure now but we found another issue where it's being sent back on redirected HTTP requests. It should be all plugged up in a bit.

Okay. The session cookie is marked secure and is sent only in response to HTTPS requests. That should cover everything.

Somebody get this guy some karma.

Re: GitHub moves to SSL, but remains Firesheepable

#6

Post by colbyolson » Wed, Nov 03, 2010, 6:46 PM UTC

It's nice to see GitHub jumping to show action in regards to FireSheep and SSL security, and being able to implement something quickly.

I wish other sites were able to follow suit.

Re: GitHub moves to SSL, but remains Firesheepable

#7

Post by awesome123 » Wed, Nov 03, 2010, 7:17 PM UTC

Maybe I shouldn't be so naive, but this whole firesheep release is very shocking to me. Facebook is very insecure, and it is incredibly scary that so many people trust Facebook's privacy and give Facebook so much personal information.

Re: GitHub moves to SSL, but remains Firesheepable

#8

Post by mrduncan » Wed, Nov 03, 2010, 8:24 PM UTC

colbyolson wrote: post #6

It's nice to see GitHub jumping to show action in regards to FireSheep and SSL security, and being able to implement something quickly. I wish other sites were able to follow suit.

They need users to be confident in their ability to run a secure service, especially when company secrets (source code, in this case) are on the line.

Also, their audience is much more likely to pay attention to things like FireSheep. I can just about guarantee that 9/10 Facebook users have never heard of FireSheep and wouldn't even notice if Facebook went 100% SSL tomorrow.

Edit: That said, I totally agree with your comment.

Re: GitHub moves to SSL, but remains Firesheepable

#9

Post by abraham » Wed, Nov 03, 2010, 9:53 PM UTC

And yet all of his Twitter links are non SSL...

Re: GitHub moves to SSL, but remains Firesheepable

#10

Post by Fluxx » Thu, Nov 04, 2010, 12:24 AM UTC

awesome123 wrote: post #7

Maybe I shouldn't be so naive, but this whole firesheep release is very shocking to me. Facebook is very insecure, and it is incredibly scary that so many people trust Facebook's privacy and give Facebook so much personal information.

Well part of the reason this is so exploitable is because with Wifi, packets are broadcast through the air for anyone to pick up. With modern switched networks, packets only get routed to the IP they're intended for.