Slashdot Mirror
HTTPS Everywhere Gets Firesheep Protection
coondoggie writes "The Electronic Frontier Foundation today said it rolled out a version of HTTPS Everywhere that
offers protection against 'Firesheep' and other tools that seek to exploit webpage security flaws. Hitting the streets in October, Firesheep caused a storm of controversy over its tactics, ethics and Web security in general. Firesheep sniffs unencrypted cookies sent across open WiFi networks for unsuspecting visitors to Web sites such as Facebook and Twitter, and lets the user take on those visitors' log-in credentials."
Does wikipedia work with HTTPS Everywhere now? I had to disable it because of all the 404 error messages I was getting.
There's no substitute for end-to-end encryption.
Wait, unencrypted signals sent over the air with your password and login is bad? If only someone had told me... /snark
Seriously though: Unencrypted. Open. Network. Come'on guys.
#fuckbeta #iamslashdot #dicemustdie
Stated simply, many web sites just can't handle https.
Does it parse the webpage you are on and rewrite every link to use HTTPS or, better, does it intercept every request Firefox makes and rewrite that before it is sent?
The reason I'm interested is that I want to create an extension that does rewrites in the latter way described, but don't know how to do it.
Swedish plasma phys. PhD student; MSc EE; knows maths, programming, electronics; finance interest; seeks opportunities
SSL = Great
SSL + some 600 MITM-Orgs your browser "trusts" = Bullshit
Use HTTPS Everywhere anyway. Great plugin. But forget your much-touted "sense-of-security" because it can't exist in light of the above.
The 0.9.0 release of HTTPS Everywhere is a new beta version designed to offer improved protection against Firesheep. Most notably, it can provide much better protection for Facebook, Twitter and Hotmail accounts, as well as completely new protection for bit.ly, Dropbox, Amazon AWS, Evernote, Cisco and Github. Unfortunately, in order to obtain maximum Firesheep protection, especially on Facebook, you must take two extra steps:
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
B-b-b-but how am I supposed to get on teh intertubes at school? :(
I can't wait for CAsheep....
This is the kinda post someone who does not live outside their own box and doesnt understand how the rest of the world works, and who doesnt understand the the majority of people have zero idea how technology works.
I don't give a rats ass if somebody else in the cafe also wants to know the weather, or also wants to read about Linux concepts...
Don't use unsecured wireless for sensitive stuff.
All stuff is sensitive. Would you like to have e.g. your windows updates guid sniffed and used by some middle east or wherever guys later? Then you=them in terms of tracking by certain agencies, etc.
windowsupdate.microsoft.com: To provide you with the best possible service, Windows Update also tracks and records how many unique machines visit its site and whether the download and installation of specific updates succeeded or failed. In order to do this, the Windows operating system generates a Globally Unique Identifier (GUID) that is stored on your computer to uniquely identify it.
If you are using an open wireless you have the same http/https issues everyone else has, regardless of the device you are using.
It's actually pretty common, and possibly even the norm.
You can't just use a pre-shared key, so you have to use WPA enterprise. (a PSK is only slightly better than open, for privacy, if everyone knows it, and not terribly useful for regulating access to the network if you only want school affiliates to use the wireless resources).
Often times you can't use the more common EAP types because the authentication data isn't stored in a way that's friendly to your radius servers.
So now you have to write all sorts of documentation like "download this application that will take over your laptop's wireless card and you'll lose all your old network configs" or "Look for how your wireless card's supplicant configures EAP, and chose EAP-TLS, and then if it asks, select from the list of trusted certificate authorities verisign." Now get this information to all the users without standing around with out hiring a town crier, and hope that users actually read *and understand* the information when they don't even know if they've got a 32 of 64 bit system...
So, while it is simple for you to configure your linksys wireless network at home, it isn't nearly as easy in the real world.
Thanks but I am unclear do the apps use http or https to communicate?
Is there any way of knowing what security the apps are using to communicate with the service.
This is important to consider as I haven't seen an iPhone app have an option of securing their connection with remote services. Most people use apps for things like facebook and are entirely at the liberty of the apps' security. There is no 'use https' choice if it doesn't do so.
If this were really happening, what would you think?
Assume sites want to prevent firesheep, and do not want https everywhere. Does secure cookies fix this?
Login via HTTPS, get secure cookie ("the token") . Then on each page load, use this token to sign your request.
This can be done with existing technology, but requires Javascript.
-- I was raised on the command line, bitch
It's not as simple as that. The traffic is encrypted only during one part of the way from your computer to the server, so cookies can be sniffed anywhere from the wireless router to the server. But it is as simple as using HTTPS. Then all traffic is encrypted all the way from your computer to the server, and you also have the stronger guarantee that your computer is talking to the server you think it is, so you cookies cannot be sniffed by third parties. StartSSL offers free SSL certificates to allow any site to encrypt all of its traffic.
What a fool believes, he sees, no wise man has the power to reason away.
Enterprise or Pre-shared key WPA? Pre-shared keys are only marginally better than open, if everyone knows the key. If I know the PSK, I can force you to rekey your session then your traffic is unencrypted to me and I can use firesheep on you.
And the fact that they use "mac-filter" leads me to think it is just PSK.
That isn't to say these mechanisms are completely worthless, but they're not super-valuable.
And I stand by my initial statement -- enterprise WPA in a university setting where you don't manage the end stations is hard.
The HTTP Strict-Transport-Security (HSTS) header and its predecessors, X-Force-HTTPS and X-Force-TLS, enable HTTP sites to declare that and how they want to be accessed over a secure connection.
The HSTS header is not recognized by Firefox 3.x. Firefox 4 supports it but without an UI. The extensions ForceTLS and STS UI deal with that, respectively.
These extensions should be merged with HTTPS Everywhere. It's unreasonable to expect people to manually enter all the sites they use, and it's equally unreasonable to rely on the EFF for maintaining a catalog of the web. We need automatic discovery, and we need manual entries too -- for sites that don't use the header, and to avoid that first insecure connection to retrieve the header.
StartSSL offers free SSL certificates to allow any site to encrypt all of its traffic.
But you will need a separate IPv4 address for each certificate, which usually means a separate IPv4 address for each domain. Will all Windows XP clients be upgraded to an OS that use Server Name Indication before ARIN runs out of IPv4 addresses? I don't think that's likely.
HTTPS take more processing power to encrypt and decrypt the traffic
This might be a valid concern for static web pages. But the sorts of web sites with which one would use TLS are more dynamic, to the point where they might be called web applications. How much processing power does HTTPS use compared to what the PHP/Python/Perl/Java app and the database use?
it's always in addition to what the PHP/Perl/Python/Java uses.
But how much addition? Would HTTPS increase the CPU load of a typical PHP blog, forum, or wiki engine by 1%, 10%, 100%, or more?
I need to look this up, but does anyone know how to use this on an unjailbroken ipod, or how about the facebook application on the ipod?
:-P
I know the dangers and concerns, but I still use unencrypted wifi like all those that don't even have a clue. I suppose I'm the worst of all... but I bet I'm not alone. It really is amazing how a system with so many vulnerabilities manages to stay together and grow for decades
If you can read this... 01110101 01110010 00100000 01100001 00100000 01100111 01100101 01100101 01101011
https://twitter.com/ almost works, but I sniffed the packets using Wireshark and unfortunately they still make one HTTP request, which because the session cookie is not marked secure is sent insecurely along with it. I remember reading that it was made using XMLHTTPRequest.
We would atleast still need something like DNSSEC to validate what is stored in DNS. So that we can store in DNS, not just the A- or AAAA-record, but also which CA is allowed to sign your certificates.
But by the time you're using DNSSEC, the domain registry is already acting as an ersatz CA by signing the CERT record (RFC 4398) that you have added to your domain. So I agree that DNSSEC is the real answer to TLS PKI.