"I tested several times and each time I found an application that asked me to "continue" to a "regular connection", my default Account Security settings reverted to HTTP."
Re:Ashton Kutcher's Twitter Account Hacked at TED
by calloc on Wednesday March 02, 2011 @11:39PM
(#2282840)
Just make sure you don't use any part of the Facebook platform (that includes commenting on various sites, like buttons) or apps within Facebook as using any of them will revert the SSL setting back to off in the settings.
Re:Ashton Kutcher's Twitter Account Hacked at TED
by rdl on Wednesday March 02, 2011 @09:47PM
(#2282515)
End to end crypto is great, but I generally use a VPN whenever logging in from a public network for all traffic, just to avoid this -- anyone sniffing my Gig-E uplink at the colo, or the backbone, or the site, will hopefully only see SSL traffic to sites, but just in case, I'd rather put an extra barrier up for the easy coffeeshop wireless sniffing attacker.
Re:Ashton Kutcher's Twitter Account Hacked at TED
by cookiecaper on Wednesday March 02, 2011 @11:39PM
(#2282841)
I came here to post this. You don't have to sit around and wait for Twitter to implement SSL. Many who implement SSL don't do so correctly anyway.
If you're using a public internet connection, make sure you're at least using a SOCKS proxy to browse or IM. Pretty simple setup: ssh -ND 8001 me@myserver, and use proxy localhost:8001.
Re:Ashton Kutcher's Twitter Account Hacked at TED
by yuhong on Thursday March 03, 2011 @02:49AM
(#2283232)
> Many who implement SSL don't do so correctly anyway.
Yea, be careful in particular with mixed content. Depending on the origin of the insecure content and depending on whether the cookie was marked as "secure", these may or may not leak plaintext cookies.
Re:Ashton Kutcher's Twitter Account Hacked at TED
by TGJ on Wednesday March 02, 2011 @11:06PM
(#2282775)
Sad to see this in relation to TED talks. The TED site has a great deal of integrity so seeing someone hack a person's twitter account is disheartening. No matter the cause, taking someone's account just to prove a silly point is wrong.
Re:Ashton Kutcher's Twitter Account Hacked at TED
by timtadh on Wednesday March 02, 2011 @10:21PM
(#2282636)
I agree. This strikes me as non-news. Side-jacking is a bad thing. We get it. Use VPN, use SSH tunneling, in general don't be dumb when using an open network. If possible use the https version.
I had to read that sentence like five times in order for it to make sense.
http://en.wikipedia.org/wiki/Garden_path_sentence
Facebook does now have an 'enable SSL by default' option.
Account> Account Settings> Account Security> Secure Browsing (https)
http://www.f-secure.com/weblog/archives/00002106.html
"I tested several times and each time I found an application that asked me to "continue" to a "regular connection", my default Account Security settings reverted to HTTP."
If you're using a public internet connection, make sure you're at least using a SOCKS proxy to browse or IM. Pretty simple setup: ssh -ND 8001 me@myserver, and use proxy localhost:8001.
Yea, be careful in particular with mixed content. Depending on the origin of the insecure content and depending on whether the cookie was marked as "secure", these may or may not leak plaintext cookies.
https://twitter.com FTW