Firesheep, Week+ later

Re:Firesheep, Week+ later by eridius on Wednesday November 03, 2010 @04:01AM (#1864108)

Yes, the problem was known before-hand by security researchers and a number of other people involved in web development. That doesn't mean it was known to users or to the developers of GitHub. In fact, given the fast response by GitHub and the tweet by pjhyett (http://twitter.com/#!/pjhyett/status/28924943340), it definitely appears that the GitHub team were not aware of this issue prior to the release of Firesheep. In any case, the release of Firesheep dramatically increased the likelyhood of this particular hole being exploited in the wild. The responsible action would have been for the author of Firesheep to notify the targeted sites about this hole with a reasonable delay before releasing the tool. His point would have still been made, but the sites that were willing to fix this would have been able to put a fix in place before users were unnecessarily left exposed.

[ Parent | on HN ]

Re:Firesheep, Week+ later by asg on Wednesday November 03, 2010 @04:52AM (#1864211)

I'm sorry, but this is a cop-out. Even five minutes of thought on how you authenticate your users would have shown that it depends on one string being a secret. Most people acknowledge that passwords shouldn't be passed in the clear. So what's the difference between a password and a session cookie in terms of its sensitivity. This is security 101. I think its highly irresponsible, and a disservice to users of all web applications, to suggest that this is new in any sense.

And, in a practical sense, who would you have expected the creators of firesheep to have warned? The top100 sites? the top500? At what point should github have entered the list? Again, this is not a vulnerability in a specific app, its a well known design error.

[ Parent | on HN ]

Re:Firesheep, Week+ later by pjhyett on Wednesday November 03, 2010 @06:52AM (#1864389)

The vulnerability is wide-spread, but Firesheep was released with handlers written targeting specific sites, including GitHub.

So, yes, I would have appreciated a heads up from those guys.

[ Parent | on HN ]

Re:Firesheep, Week+ later by asg on Sunday November 07, 2010 @06:28AM (#1879153)

OK, I understand why creating specific handlers might warrant a heads up.

I suppose I'm unsympathetic since every authenticated web app I've done in the last 10 years has been SSL only. But that was too 'enterprisey' perhaps :). Also I imagine that this is such an obvious thing, it wasn't a case of being unaware of the issue, just taking a conscious risk-reward decision on being SSL-only. Particularly for the really smart developers at github. One could argue that since nothing bad (that we know of) happened before firesheep, it was a valid decision.

All in all, I think Firesheep has done a big favour to the web as a whole.

PS. this thread has degenerated to using github as an example, I should probably point out that I love and respect github. really.

[ Parent | on HN ]