cdine
Joined 16 years ago
Karma
860
Submissions
28
Member since
Mar 2
my public key: https://keybase.io/crash; my proof: https://keybase.io/crash/sigs/ZhoY4fclRo8oQWagxVf8CIdmfvKP8bITaptnKHZXsSM
View on Hacker NewsRecent submissions
Comment · 7 years ago
Thanks! That was the goal. For those who aren't familiar, the original slides and our response blog posts are still up: https://codebutler.com/projects/firesheep/
Comment · 7 years ago
Firesheep co-author here. Thanks and agreed :)
Comment · 12 years ago
Source: https://github.com/SecurityInnovation/PGPy
Documentation: https://pythonhosted.org/PGPy/
Comment · 15 years ago
For some time I've ran a box with PF forwarding all TCP ports to an SSH server. That plus a simple nmap connect scan has proved handy for countless annoying networks that try to block "common" ports, poorly configured captive portal networks, etc. It's amazing how many "restricted" networks allow TCP 1, 53, 1723, 8080, and a few others out to the open net.
Comment · 16 years ago
Indeed, Loopt appears to be one of the few high-profile sites to have done this right. SSL for everything, and cookies that are relevant to login sessions are marked secure. This is what we need everywhere!
Comment · 16 years ago
Most sites don't properly invalidate sessions when you log out, you can't protect yourself as well as you think. See our slide on this topic:
Comment · 16 years ago
It's 100% open source! Please feel free to review it.
http://github.com/codebutler/firesheep
It doesn't currently do anything with passwords, it's only pulling out cookies from HTTP Response headers. But it would be trivial to also get passwords in non-HTTPS requests for logins with the same method.
Comment · 16 years ago
Yup, they're one of our examples of a "good" setup. However, Google leaks iGoogle and some other things (Latitude, address book, reader, ...)
Comment · 16 years ago
HTTPS Everywhere only works on a select few sites. You're up a creek for anything it doesn't cover.
And Tor, there's lots of cases where operators did bad things. Don't trust it for sensitive information. http://blog.ironkey.com/?p=201
Comment · 16 years ago
This vulnerability (it hurts to even call it such at this point) has been around for years, and the attack has always been easy for a determined attacker to carry out.
How else are we going to convince people to secure their sites and protect their users? People have been presenting on this issue for years (Ferret & Hamster, Blackhat 2007) and companies haven't responded/cared. It's possible to solve this problem (Gmail is all HTTPS, and done correctly, Amazon has a tiered authentication system that properly uses SSL for important things, Wordpress does SSL right for accessing their admin interface) - companies need to step up and address the issue.