Posted on 11/08/2010 8:19:41 PM PST by Gomez
Firefox extension created to shine a light on the problem of unencrypted websites fails, because rather than offering a solution, it only makes it worse.
Most people know that public Wi-Fi hotspots aren't the safest connections in the world and probably aren't the best place to be doing things like online banking. But you probably didn't realize just how easy it is to steal logins for email and services like Facebook from other people on a hotspot.
Well, thanks to a new Firefox extension called Firesheep, anyone can easily view other people on their network and, with a click of a button, assume another person's identity and login credentials from any non-secure site that the unwitting person is logged into.
Firesheep was created by two developers who are hoping to shine a light on the problem of websites that don't use SSL encryption throughout an entire user session. It has always been easy for the bad guys to view and steal login information from users accessing non HTTPS-secured websites and Firesheep is just making that a whole lot easier.
To a certain degree this is a worthwhile cause. Too many sites put users at risk of giving away their login information by their failure to use secure connections. However, I wish the Firesheep developers could have made their point without putting this tool in the hands of bad guys, cranky teens, and disgruntled employees everywhere.
And don't think that because a webmail site or ecommerce site uses SSL for the login page that you're safe. If SSL isn't enabled for the entire session, someone using Firesheep can still take over your account after you've logged in.
Also, this problem isn't limited to Wi-Fi hotspots. Someone using Firesheep can see and steal the login information from anyone on a shared network segment, whether that's a hotspot, a home network, or a company network.
So what can you do to avoid the dangers of Firesheep (and the older sniffing tools familiar to real hackers)?
For those traveling or using public networks and hotspots, a VPN is probably your best option, as it will encrypt your entire Internet connection. But not everyone has access to a VPN, especially when it comes to non-business users.
The second best option is to make sure that the site you are using has https enabled throughout the entire session. Some sites, like Google Gmail, now do this by default, but that isn't the case for every site.
Browser extensions such as HTTPS Everywhere and Force-TLS will make sure that your browser uses a secure connection when it is available.
However, not every site has the capability to run under HTTPS for an entire session. Some sites use it only for login (which doesn't protect you against Firesheep) and some don't use it at all.
In these cases, if you don't have a VPN handy, then I would advise not using these sites or services at all when you are on a network that you don't trust 100%.
Of course the best solution would be for all sites that need to protect user information, whether they are webmail, social networks, or ecommerce sites, to use HTTPS all the time.
And with the threat of Firesheep out there, they all might finally do that.
ping
Your FR account can be taken over by someone on the same network, including WiFi hotspors, with a few mouse clicks.
If you use a WiFi connection anywhere, even if it is encrypted, but otherwise shared among everyone at the coffee shop you’re at, this utility makes it automatic to steal your Free Republic, Amazon, Facebook, etc. login. It doesn’t matter if you logged in using “https” if you are brought back to a “http” screen afterward, as that is what Yahoo Mail and Hotmail even do to you.
In short, you are screwed if you don’t use a VPN. Good luck putting together a cheap, easy VPN for all of your friends.
That’s not my screenshot.
(Almost) all your airport and coffee-shop WiFi logins are belong to Firesheep.
So when does John Robinson release https://www.freerepublic.com?
If you want on or off the Mac Ping List, Freepmail me.
BTTT
bttt
Man up. You posted it. Take responsibility.
:)
Partially true. If you log into a site using SSL (HTTPS) and the site reverts to non-SSL after the login, you're at risk. If you're on a banking website, for instance, that offers HTTPS before, during, and after login, you're (relatively) safe. If you're on an unsecured network, your packets can be sniffed, but if the data is encrypted in transit, they can't decrypt it.
WPA2 with SSL is safe; WEP with SSL is not if you leave the SSL session; no wireless security with SSL is insecure; WPA2 without SSL is also insecure. Essentially keep yourself on secure wireless networks and use SSL encryption or VPN to prevent data breaches.
BFL.
Thank you. I don’t go to wifi hot spots, so I thought I was safe, this makes me think not so?
I”m sorry, what is a vpn?
VPN = “virtual private network”
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.