You might want to think twice about logging into your Facebook account or Tweeting the next time you're on a public Wi-Fi hotspot. As TechCrunch reports, a new Firefox extension called Firesheep is causing quite a stir. It allows basically anyone to harvest other users' log-in information with a simple, easy-to-use interface. In the words of the Firesheep website, "As soon as anyone on the network visits an insecure website known to Firesheep, their name and photo will be displayed. . . . Double-click on someone, and you're instantly logged in as them."
The Firesheep information page provides some interesting background information. In short, the developer seems to be taking an ends-justify-the-means approach to helping secure popular websites:
It's extremely common for websites to protect your password by encrypting the initial login, but surprisingly uncommon for websites to encrypt everything else. This leaves the cookie (and the user) vulnerable. HTTP session hijacking (sometimes called "sidejacking") is when an attacker gets a hold of a user's cookie, allowing them to do anything the user can do on a particular website. On an open wireless network, cookies are basically shouted through the air, making these attacks extremely easy.
This is a widely known problem that has been talked about to death, yet very popular websites continue to fail at protecting their users. The only effective fix for this problem is full end-to-end encryption, known on the web as HTTPS or SSL
The extension is available free of charge for Windows and Mac OS X, and the source code can be downloaded here. You may start panicking in three, two, one...
|1. BIF - $340||2. chasp_0 - $251||3. mbutrovich - $250|
|4. Ryu Connor - $250||5. YetAnotherGeek2 - $200||6. aeassa - $175|
|7. dashbarron - $150||8. Lucky Jack Aubrey - $100||9. Captain Ned - $100|
|10. Anonymous Gerbil - $100|
|AMD adds refresh-rate ranges to its FreeSync monitor page||5|
|Rumor: Early Broadwell-E benches hint at solid performance gains||35|
|HP refreshes Pavilion consumer PC lineup||5|
|Nvidia teases Pascal GeForces amid GTX 1000-series rumors||42|
|Philips' new 43-inch monitor might make native 4K practical||53|
|Alleged Kaby Lake CPU shows its face in SiSoft Sandra database||27|
|Dell will become Dell Technologies after its EMC buyout||6|
|Nvidia and Samsung settle long-running patent litigation||16|
|Oculus Rift demos go on the road starting May 7||13|
|Is this a review of a review?||+24|