Hacker News Reader

Comment by ericflo | Hacker News Reader

I don't understand your argument here--are you saying we shouldn't mind if the vulnerable sites aren't Facebook or Twitter?

View on HN

I think he's arguing that since both twitter and facebook (and other unnamed sites) do not use adsense, but are still vulnerable to firesheep, there must be another reason why developers don't update the security for their website.

Facebook has an HTTPS version, but Facebook Chat doesn't work over HTTPS.

Unfortunately, Facebook's XMPP service doesn't utilise SSL either. They hash the password, but everything else is trivally decodable on the wire. Plus there was the hole in Facebook chat which exposed your conversations to your friends earlier this year. Possibly the worse IM system in existence.

Facebook's HTTPS site is utterly useless.

1. Go to https://www.facebook.com/

2. Log in.

3. Immediately you get redirected back to http://www.facebook.com WTF?!

4. Click logout.

5. Go back to https://www.facebook.com/

6. This time you get redirected to https://ssl.facebook.com/ and you're STILL LOGGED IN.

Actually now that I try the same thing with the non-SSL version of the site I have the same problem. WTF is going on? The only way I'm able to log out is by deleting the facebook.com cookies.

I'm on Safari 5.

I would have tested the cases for you, but fortunately, I have deleted my FB account. I dont trust them with anything.

I use HTTPS Everywhere to force Facebook to use SSL. I can't comment on the effectiveness of their site under normal conditions.

hes saying that most sites that use adsense do not require a login, thus do not need https. he is somewhat correct, but not enough for google to just ignore this issue.

Most content sites have login systems that people use to customize their experience, post comments or upload content, etc. Millions and millions and millions of people are logged into content sites and are vulnerable to this attack.

Also, I disagree on the premise that adsense is mostly used on content sites. It's used on all kinds of websites.

Most notably would be the oodles of forums out there that are ad supported and require logging in.

There are sites that make use of sessions without forcing you into using an account. These are also vulnerable.

Well, sometimes for strange values of "vulnerable".

Some of my sites use Apache::Session over non secured http connections, which makes them technically "vulnerable".

The only practical thing an attacker can do with those session ids though, is to mess with some custom visitor tracking in my management backend. So perhaps my information about whether a particular inquiry visited my terms and conditions page or my privacy policy page will be wrong. I can live with that.

Reply on news.ycombinator.com